OTF-006: Broken Website Hardening Control: The CSP can be turned on or off but not configured for the specific needs of the website
CVE-2022-21694

3.7LOW

Key Information:

Vendor

Onionshare

Status
Onionshare
Vendor
CVE Published:
18 January 2022

What is CVE-2022-21694?

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. The website mode of the onionshare allows to use a hardened CSP, which will block any scripts and external resources. It is not possible to configure this CSP for individual pages and therefore the security enhancement cannot be used for websites using javascript or external resources like fonts or images.

Affected Version(s)

onionshare < 2.5

References

https://github.com/onionshare/onionshare/releases/tag/v2.5
x_refsource_MISC
https://github.com/onionshare/onionshare/security/advisor...
x_refsource_CONFIRM
https://github.com/onionshare/onionshare/issues/1389
x_refsource_MISC

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.