Local File Overwrite Vulnerability in OnionShare by Onion
CVE-2018-19960

7HIGH

Key Information:

Vendor

Onionshare

Status
Onionshare
Vendor
CVE Published:
7 December 2018

What is CVE-2018-19960?

The debug_mode function within web/web.py in OnionShare prior to version 1.4 utilizes the /tmp/onionshare_server.log file for logging when --debug is enabled. This implementation flaw may enable local attackers to overwrite files or access sensitive data, posing significant risks to system integrity and data confidentiality.

References

https://bugs.debian.org/915859
x_refsource_MISC

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.