CVE-2022-21690: OTF-001: Improper Input Sanitation: The path parameter of the requested URL is not sanitized before being passed to the QT frontend
(updated )
Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund’s Red Team lab. This is an issue from that penetration test.
- Vulnerability ID: OTF-001
- Vulnerability type: Improper Input Sanitization
- Threat level: Elevated
References
- github.com/advisories/GHSA-ch22-x2v3-v6vq
- github.com/onionshare/onionshare
- github.com/onionshare/onionshare/releases/tag/v2.5
- github.com/onionshare/onionshare/security/advisories/GHSA-ch22-x2v3-v6vq
- github.com/pypa/advisory-database/tree/main/vulns/onionshare-cli/PYSEC-2022-41.yaml
- nvd.nist.gov/vuln/detail/CVE-2022-21690
Code Behaviors & Features
Detect and mitigate CVE-2022-21690 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →