CVE-2022-21694 - CVE House
Back to Database
Status published Low CVE-2022-21694

OTF-006: Broken Website Hardening Control: The CSP can be turned on or off but not configured for the specific needs of the website

Vulnerability Description

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. The website mode of the onionshare allows to use a hardened CSP, which will block any scripts and external resources. It is not possible to configure this CSP for individual pages and therefore the security enhancement cannot be used for websites using javascript or external resources like fonts or images.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-21694

Credits & Attribution

No credits recorded in the NVD database.

References

More from onionshare

View All →
CVE-2022-21696
Username spoofing in OnionShare
Medium 4.3
CVE-2022-21695
Improper Access Control in Onionshare
Medium 4.3
CVE-2022-21693
Path traversal in Onionshare
Medium 6.3
CVE-2022-21692
Improper Access Control in Onionshare
Medium 4.3
CVE-2022-21691
Improper Access Control in Onionshare
Medium 4.3

Affected Vendor

Affected Software

onionshare
Vulnerable Versions:
< 2.5

Timeline

Official Publish: January 18th, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-732

MITRE ATT&CK TTPs

T1222 File and Directory Permissions Modification
Defense Evasion
T1574 Hijack Execution Flow
Privilege Escalation
T1005 Data from Local System
Collection
T1078 Valid Accounts
Persistence
T1562 Impair Defenses
Defense Evasion