CVE-2022-21696 (GCVE-0-2022-21696)
Vulnerability from cvelistv5 – Published: 2022-01-18 19:55 – Updated: 2025-04-23 19:11
VLAI
EPSS
VEX
Title
Username spoofing in OnionShare
Summary
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-23 14:12 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/onionshare/onionshare/security… | x_refsource_CONFIRM |
| https://github.com/onionshare/onionshare/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| onionshare | onionshare |
Affected:
< 2.5
|
guessed |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T02:53:34.799Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-21696",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T14:12:06.972881Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-23T19:11:08.548Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "onionshare",
"vendor": "onionshare",
"versions": [
{
"status": "affected",
"version": "\u003c 2.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-18T19:55:10.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5"
}
],
"source": {
"advisory": "GHSA-68vr-8f46-vc9f",
"discovery": "UNKNOWN"
},
"title": "Username spoofing in OnionShare",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-21696",
"STATE": "PUBLIC",
"TITLE": "Username spoofing in OnionShare"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "onionshare",
"version": {
"version_data": [
{
"version_value": "\u003c 2.5"
}
]
}
}
]
},
"vendor_name": "onionshare"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20: Improper Input Validation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f",
"refsource": "CONFIRM",
"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f"
},
{
"name": "https://github.com/onionshare/onionshare/releases/tag/v2.5",
"refsource": "MISC",
"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5"
}
]
},
"source": {
"advisory": "GHSA-68vr-8f46-vc9f",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-21696",
"datePublished": "2022-01-18T19:55:10.000Z",
"dateReserved": "2021-11-16T00:00:00.000Z",
"dateUpdated": "2025-04-23T19:11:08.548Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2022-21696",
"date": "2026-10-29",
"epss": "0.00714",
"percentile": "0.53613"
},
"fkie_nvd": {
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:onionshare:onionshare:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B3A7A46B-5812-492A-B66B-DC43A15A0A38",
"versionEndExcluding": "2.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username."
},
{
"lang": "es",
"value": "OnionShare es una herramienta de c\u00f3digo abierto que permite compartir archivos, alojar sitios web y chatear con amigos de forma segura y an\u00f3nima usando la red Tor. En las versiones afectadas es posible cambiar el nombre de usuario por el de otro participante en el chat con un car\u00e1cter de espacio adicional al final de la cadena del nombre. Un adversario con acceso al entorno del chat puede usar la funcionalidad rename para suplantar a otros participantes al a\u00f1adir caracteres de espacio en blanco al final del nombre de usuario"
}
],
"id": "CVE-2022-21696",
"lastModified": "2024-11-21T06:45:15.177",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-01-18T20:15:07.900",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5"
},
{
"source": "security-advisories@github.com",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "onionshare",
"vendor": "onionshare",
"versions": [
{
"status": "affected",
"version": "\u003c 2.5"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:onionshare:onionshare:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B3A7A46B-5812-492A-B66B-DC43A15A0A38",
"versionEndExcluding": "2.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username."
},
{
"lang": "es",
"value": "OnionShare es una herramienta de c\u00f3digo abierto que permite compartir archivos, alojar sitios web y chatear con amigos de forma segura y an\u00f3nima usando la red Tor. En las versiones afectadas es posible cambiar el nombre de usuario por el de otro participante en el chat con un car\u00e1cter de espacio adicional al final de la cadena del nombre. Un adversario con acceso al entorno del chat puede usar la funcionalidad rename para suplantar a otros participantes al a\u00f1adir caracteres de espacio en blanco al final del nombre de usuario"
}
],
"id": "CVE-2022-21696",
"lastModified": "2026-06-17T04:26:46.950",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-21696",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T14:12:06.972881Z",
"version": "2.0.3"
}
}
]
},
"published": "2022-01-18T20:15:07.900",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5"
},
{
"source": "security-advisories@github.com",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2025-11-21T16:01:43+00:00",
"cve": "CVE-2022-21696",
"id": "CVE-2022-21696",
"initial_release_date": "2022-01-18T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "onionshare: improper input validation",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21696.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "important",
"current_release_date": "2025-03-15T07:49:35Z",
"cve": "CVE-2022-21696",
"id": "CVE-2022-21696",
"initial_release_date": "2023-02-15T03:29:07Z",
"product_status:recommended": "2",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2022-21696",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-21696.json",
"version": "6"
},
"vulnrichment": {
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T02:53:34.799Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-21696",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T14:12:06.972881Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-23T14:12:08.454Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "onionshare",
"vendor": "onionshare",
"versions": [
{
"status": "affected",
"version": "\u003c 2.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-18T19:55:10.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5"
}
],
"source": {
"advisory": "GHSA-68vr-8f46-vc9f",
"discovery": "UNKNOWN"
},
"title": "Username spoofing in OnionShare",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-21696",
"STATE": "PUBLIC",
"TITLE": "Username spoofing in OnionShare"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "onionshare",
"version": {
"version_data": [
{
"version_value": "\u003c 2.5"
}
]
}
}
]
},
"vendor_name": "onionshare"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20: Improper Input Validation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f",
"refsource": "CONFIRM",
"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f"
},
{
"name": "https://github.com/onionshare/onionshare/releases/tag/v2.5",
"refsource": "MISC",
"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5"
}
]
},
"source": {
"advisory": "GHSA-68vr-8f46-vc9f",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-21696",
"datePublished": "2022-01-18T19:55:10.000Z",
"dateReserved": "2021-11-16T00:00:00.000Z",
"dateUpdated": "2025-04-23T19:11:08.548Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
CNVD-2022-06471
Vulnerability from cnvd - Published: 2022-01-25
VLAI
Title
OnionShare输入验证错误漏洞
Description
OnionShare是一种开源工具。用于安全且匿名地共享文件、托管网站以及使用 Tor 网络与朋友聊天。
OnionShare存在输入验证错误漏洞，攻击者可利用该漏洞通过名称字符串末尾的额外空格字符将用户名更改为另一个聊天参与者的用户名。
Severity
中
Patch Name
OnionShare输入验证错误漏洞的补丁
Patch Description
OnionShare是一种开源工具。用于安全且匿名地共享文件、托管网站以及使用 Tor 网络与朋友聊天。
OnionShare存在输入验证错误漏洞，攻击者可利用该漏洞通过名称字符串末尾的额外空格字符将用户名更改为另一个聊天参与者的用户名。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/onionshare/onionshare/releases/tag/v2.5
Reference
https://nvd.nist.gov/vuln/detail/CVE-2022-21696
Impacted products
| Name | OnionShare OnionShare |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2022-21696"
}
},
"description": "OnionShare\u662f\u4e00\u79cd\u5f00\u6e90\u5de5\u5177\u3002\u7528\u4e8e\u5b89\u5168\u4e14\u533f\u540d\u5730\u5171\u4eab\u6587\u4ef6\u3001\u6258\u7ba1\u7f51\u7ad9\u4ee5\u53ca\u4f7f\u7528 Tor \u7f51\u7edc\u4e0e\u670b\u53cb\u804a\u5929\u3002\n\nOnionShare\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u540d\u79f0\u5b57\u7b26\u4e32\u672b\u5c3e\u7684\u989d\u5916\u7a7a\u683c\u5b57\u7b26\u5c06\u7528\u6237\u540d\u66f4\u6539\u4e3a\u53e6\u4e00\u4e2a\u804a\u5929\u53c2\u4e0e\u8005\u7684\u7528\u6237\u540d\u3002",
"formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/onionshare/onionshare/releases/tag/v2.5",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2022-06471",
"openTime": "2022-01-25",
"patchDescription": "OnionShare\u662f\u4e00\u79cd\u5f00\u6e90\u5de5\u5177\u3002\u7528\u4e8e\u5b89\u5168\u4e14\u533f\u540d\u5730\u5171\u4eab\u6587\u4ef6\u3001\u6258\u7ba1\u7f51\u7ad9\u4ee5\u53ca\u4f7f\u7528 Tor \u7f51\u7edc\u4e0e\u670b\u53cb\u804a\u5929\u3002\r\n\r\nOnionShare\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u540d\u79f0\u5b57\u7b26\u4e32\u672b\u5c3e\u7684\u989d\u5916\u7a7a\u683c\u5b57\u7b26\u5c06\u7528\u6237\u540d\u66f4\u6539\u4e3a\u53e6\u4e00\u4e2a\u804a\u5929\u53c2\u4e0e\u8005\u7684\u7528\u6237\u540d\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "OnionShare\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": "OnionShare OnionShare"
},
"referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2022-21696",
"serverity": "\u4e2d",
"submitTime": "2022-01-19",
"title": "OnionShare\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e"
}
FKIE_CVE-2022-21696
Vulnerability from fkie_nvd - Published: 2022-01-18 20:15 - Updated: 2026-06-17 04:26
Severity
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
4.3 (Medium) - CVSS:3.1/
Summary
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.
References
| URL | Tags | ||
|---|---|---|---|
| security-advisories@github.com | https://github.com/onionshare/onionshare/releases/tag/v2.5 | Release Notes, Third Party Advisory | |
| security-advisories@github.com | https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/onionshare/onionshare/releases/tag/v2.5 | Release Notes, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| onionshare | onionshare | * |
{
"affected": [
{
"affectedData": [
{
"product": "onionshare",
"vendor": "onionshare",
"versions": [
{
"status": "affected",
"version": "\u003c 2.5"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:onionshare:onionshare:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B3A7A46B-5812-492A-B66B-DC43A15A0A38",
"versionEndExcluding": "2.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username."
},
{
"lang": "es",
"value": "OnionShare es una herramienta de c\u00f3digo abierto que permite compartir archivos, alojar sitios web y chatear con amigos de forma segura y an\u00f3nima usando la red Tor. En las versiones afectadas es posible cambiar el nombre de usuario por el de otro participante en el chat con un car\u00e1cter de espacio adicional al final de la cadena del nombre. Un adversario con acceso al entorno del chat puede usar la funcionalidad rename para suplantar a otros participantes al a\u00f1adir caracteres de espacio en blanco al final del nombre de usuario"
}
],
"id": "CVE-2022-21696",
"lastModified": "2026-06-17T04:26:46.950",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-21696",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T14:12:06.972881Z",
"version": "2.0.3"
}
}
]
},
"published": "2022-01-18T20:15:07.900",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5"
},
{
"source": "security-advisories@github.com",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-68VR-8F46-VC9F
Vulnerability from github – Published: 2022-01-21 23:20 – Updated: 2024-10-08 12:39
VLAI
Summary
Username spoofing in OnionShare
Details
Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test.
- Vulnerability ID: OTF-005
- Vulnerability type: Improper Input Sanitization
- Threat level: Low
Description:
It is possible to change the username to that of another chat participant with an additional space character at the end of the name string.
Technical description:
Assumed users in Chat:
- Alice
- Bob
-
Mallory
-
Mallory renames to
Alice. - Mallory sends message as
Alice. - Alice and Bob receive a message from Mallory disguised as
Alice, which is hard to distinguish from theAlicein the web interface.
Other (invisible) whitespace characters were found to be working as well.
Impact:
An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.
Recommendation:
- Remove non-visible characters from the username
Severity
4.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "onionshare-cli"
},
"ranges": [
{
"events": [
{
"introduced": "2.3"
},
{
"fixed": "2.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-21696"
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-19T19:41:55Z",
"nvd_published_at": "2022-01-18T20:15:00Z",
"severity": "MODERATE"
},
"details": "Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund\u0027s [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.\n\n- Vulnerability ID: OTF-005\n- Vulnerability type: Improper Input Sanitization\n- Threat level: Low\n\n## Description:\n\nIt is possible to change the username to that of another chat participant with an additional space character at the end of the name string.\n\n## Technical description:\n\nAssumed users in Chat:\n\n- Alice\n- Bob\n- Mallory\n\n1. Mallory renames to `Alice `.\n2. Mallory sends message as `Alice `.\n3. Alice and Bob receive a message from Mallory disguised as `Alice `, which is hard to distinguish from the `Alice`\nin the web interface.\n\n\n\n\nOther (invisible) whitespace characters were found to be working as well.\n\n## Impact:\n\nAn adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.\n\n## Recommendation:\n\n- Remove non-visible characters from the username",
"id": "GHSA-68vr-8f46-vc9f",
"modified": "2024-10-08T12:39:16Z",
"published": "2022-01-21T23:20:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21696"
},
{
"type": "PACKAGE",
"url": "https://github.com/onionshare/onionshare"
},
{
"type": "WEB",
"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/onionshare-cli/PYSEC-2022-47.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Username spoofing in OnionShare"
}
GSD-2022-21696
Vulnerability from gsd - Updated: 2023-12-13 01:19Details
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2022-21696",
"description": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.",
"id": "GSD-2022-21696",
"references": [
"https://www.suse.com/security/cve/CVE-2022-21696.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2022-21696"
],
"details": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.",
"id": "GSD-2022-21696",
"modified": "2023-12-13T01:19:14.105445Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-21696",
"STATE": "PUBLIC",
"TITLE": "Username spoofing in OnionShare"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "onionshare",
"version": {
"version_data": [
{
"version_value": "\u003c 2.5"
}
]
}
}
]
},
"vendor_name": "onionshare"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20: Improper Input Validation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f",
"refsource": "CONFIRM",
"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f"
},
{
"name": "https://github.com/onionshare/onionshare/releases/tag/v2.5",
"refsource": "MISC",
"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5"
}
]
},
"source": {
"advisory": "GHSA-68vr-8f46-vc9f",
"discovery": "UNKNOWN"
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003c2.5",
"affected_versions": "All versions before 2.5",
"cvss_v2": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-20",
"CWE-937"
],
"date": "2022-01-21",
"description": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.",
"fixed_versions": [
"2.5"
],
"identifier": "CVE-2022-21696",
"identifiers": [
"GHSA-68vr-8f46-vc9f",
"CVE-2022-21696"
],
"not_impacted": "All versions starting from 2.5",
"package_slug": "pypi/onionshare-cli",
"pubdate": "2022-01-21",
"solution": "Upgrade to version 2.5 or above.",
"title": "Improper Input Validation",
"urls": [
"https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f",
"https://nvd.nist.gov/vuln/detail/CVE-2022-21696",
"https://github.com/onionshare/onionshare/releases/tag/v2.5",
"https://github.com/advisories/GHSA-68vr-8f46-vc9f"
],
"uuid": "ed79e733-ff0d-4e6b-a02e-21900d215c60"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:onionshare:onionshare:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.5",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-21696"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f"
},
{
"name": "https://github.com/onionshare/onionshare/releases/tag/v2.5",
"refsource": "MISC",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
},
"lastModifiedDate": "2022-01-24T20:26Z",
"publishedDate": "2022-01-18T20:15Z"
}
}
}
OPENSUSE-SU-2024:11983-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2026-09-20 20:29Summary
python-onionshare-2.5-1.1 on GA media
Severity
Moderate
Scope
8 vulnerabilities in this advisory, including CVE-2022-21696.
CVE-2022-21696
4.3 (Medium)
Recommended: 4 products
OPENSUSE-SU-2024:13635-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2026-09-20 21:04Summary
python3-onionshare-2.6-4.1 on GA media
Severity
Moderate
Scope
11 vulnerabilities in this advisory, including CVE-2022-21696.
CVE-2022-21696
4.3 (Medium)
Recommended: 4 products
PYSEC-2022-47
Vulnerability from pysec - Published: 2022-01-18 20:15 - Updated: 2022-03-09 00:16
VLAI
Details
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.
Impacted products
| Name | purl | onionshare-cli | pkg:pypi/onionshare-cli |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "onionshare-cli",
"purl": "pkg:pypi/onionshare-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.3",
"2.3.1",
"2.3.2",
"2.3.3"
]
}
],
"aliases": [
"CVE-2022-21696",
"GHSA-68vr-8f46-vc9f"
],
"details": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.",
"id": "PYSEC-2022-47",
"modified": "2022-03-09T00:16:43.504149Z",
"published": "2022-01-18T20:15:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f"
},
{
"type": "WEB",
"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5"
}
]
}
UBUNTU-CVE-2022-21696 (CVE-2022-21696)
Vulnerability from osv_ubuntu – Published: 2022-01-18 20:15 – Updated: 2025-07-16 05:01 – Source website
Withdrawn 2025-07-18
VLAI
Details
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.
Severity
4.3 (Medium)
4.3 (Medium)
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "onionshare",
"binary_version": "2.2-3"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "onionshare",
"purl": "pkg:deb/ubuntu/onionshare@2.2-3?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2-3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": []
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "onionshare",
"binary_version": "2.6-6ubuntu1"
},
{
"binary_name": "onionshare-cli",
"binary_version": "2.6-6ubuntu1"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "onionshare",
"purl": "pkg:deb/ubuntu/onionshare@2.6-6ubuntu1?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6-6ubuntu1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.6-5"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "onionshare",
"binary_version": "2.6.3-1"
},
{
"binary_name": "onionshare-cli",
"binary_version": "2.6.3-1"
}
]
},
"package": {
"ecosystem": "Ubuntu:25.04",
"name": "onionshare",
"purl": "pkg:deb/ubuntu/onionshare@2.6.3-1?arch=source\u0026distro=plucky"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.3-1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.6-6ubuntu1"
]
}
],
"aliases": [],
"details": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.",
"id": "UBUNTU-CVE-2022-21696",
"modified": "2025-07-16T05:01:07Z",
"published": "2022-01-18T20:15:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-21696"
},
{
"type": "REPORT",
"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f"
},
{
"type": "REPORT",
"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21696"
}
],
"related": [],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2022-21696"
],
"withdrawn": "2025-07-18T16:49:14Z"
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.