CVE-2022-21694 json
OTF-006: Broken Website Hardening Control: The CSP can be turned on or off but not configured for the specific needs of the website
published 2022-01-18 4 y ago modified 2026-06-17 4 mo ago also GHSA-h29c-wcm8-883h , PYSEC-2022-45 , EUVD-2022-0185
- cvss
- 3.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 69%
- public exploits
- 0
- none known
Summary
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. The website mode of the onionshare allows to use a hardened CSP, which will block any scripts and external resources. It is not possible to configure this CSP for individual pages and therefore the security enhancement cannot be used for websites using javascript or external resources like fonts or images.
Patch / fix
- pypi onionshare-cli 2.5
- onionshare onionshare 2.5
- onionshare Debian 14, Debian 13, Debian 12 2.5-1
debian advisories DEBIAN-CVE-2022-21694
- python-onionshare openSUSE Tumbleweed 2.5-1.1
- python3-onionshare openSUSE Tumbleweed 2.6-4.1
opensuse advisories openSUSE-SU-2024:11983-1openSUSE-SU-2024:13635-1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
1.26% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | onionshare-cli | >=2.2, <2.5 <2.5 |
2.5 |
Affected products
- onionshare onionshare
Classification
- Weakness
-
- CWE-732 Incorrect Permission Assignment for Critical Resource
References
-
github.com
/onionshare/onionshare/releases/tag/v2.5
web, release-notes, third-party-advisory
-
github.com
/onionshare/onionshare/security/advisories/GHSA-h29c-wcm8-883h
web, third-party-advisory, advisory
-
github.com
/onionshare/onionshare/issues/1389
web, issue-tracking, third-party-advisory, report
-
nvd.nist.gov
/vuln/detail/CVE-2022-21694
advisory
-
github.com
/onionshare/onionshare
package
-
github.com
/pypa/advisory-database/tree/main/vulns/onionshare-cli/PYSEC-2022-45.yaml
web
Sources
- CVE List CVE-2022-21694
- GitHub Advisory GHSA-h29c-wcm8-883h
- NVD CVE-2022-21694
- OSV PYSEC-2022-45
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.