VDB
CVE-2022-21690
CVE-2022-21690
PUBLISHED
CVSS 8.699999809265137 HIGH
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions The path parameter of the requested URL is not sanitized before being passed to the QT frontend. This path is used in all components for displaying the server access history. This leads to a rendered HTML4 Subset (QT RichText editor) in the Onionshare frontend.
EPSS 0.79% · 52.8th percentile
Risk Scores
CVSS 3.1
8.699999809265137
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
EPSS Score
0.79%
52.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| onionshare | onionshare | < 2.5, 0 |
| PyPI | onionshare-cli | 0 |
Timeline
- Jan 18, 2022 CVE Published
- Jan 19, 2022 PoC Published
- Feb 8, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 24, 2022 EPSS Score
- Jul 16, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
- Oct 29, 2022 EPSS Score
- Dec 21, 2022 EPSS Score
- Feb 11, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 5, 2023 EPSS Score
References
- https://github.com/onionshare/onionshare/releases/tag/v2.5 url
- https://github.com/onionshare/onionshare/security/advisories/GHSA-ch22-x2v3-v6vq url
- https://nvd.nist.gov/vuln/detail/CVE-2022-21690 advisory
- https://github.com/onionshare/onionshare package
- https://github.com/pypa/advisory-database/tree/main/vulns/onionshare-cli/PYSEC-2022-41.yaml url