CVE-2022-21696: falha de média gravidade em onionshare
Username spoofing in OnionShare
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.7%
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
onionshare · onionshareCVEs relacionadas — onionshare
No mesmo produto, das mais perigosas para as menos.
CVE-2022-21689HIGHDenial of Service in OnionshareEPSS 1.3%CVE-2022-21694LOWOTF-006: Broken Website Hardening Control: The CSP can be turned on or off but not configured for the specific needs of the websiteEPSS 1.3%CVE-2022-21693MEDIUMPath traversal in OnionshareEPSS 1.2%CVE-2022-21688HIGHOut-of-bounds Read in OnionshareEPSS 0.9%CVE-2022-21695MEDIUMImproper Access Control in OnionshareEPSS 0.9%CVE-2022-21690HIGHCross-Site Scripting in OnionshareEPSS 0.8%