Vulnerability Details CVE-2018-19960
The debug_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare_server.log pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 12.2%
CVSS Severity
CVSS v3 Score 7.0
CVSS v2 Score 4.4
Products affected by CVE-2018-19960
-
cpe:2.3:a:onionshare:onionshare:0.2
-
cpe:2.3:a:onionshare:onionshare:0.3
-
cpe:2.3:a:onionshare:onionshare:0.4
-
cpe:2.3:a:onionshare:onionshare:0.5
-
cpe:2.3:a:onionshare:onionshare:0.6
-
cpe:2.3:a:onionshare:onionshare:0.7
-
cpe:2.3:a:onionshare:onionshare:0.7.1
-
cpe:2.3:a:onionshare:onionshare:0.8
-
cpe:2.3:a:onionshare:onionshare:0.8.1
-
cpe:2.3:a:onionshare:onionshare:0.9
-
cpe:2.3:a:onionshare:onionshare:0.9.1
-
cpe:2.3:a:onionshare:onionshare:0.9.2
-
cpe:2.3:a:onionshare:onionshare:1.0
-
cpe:2.3:a:onionshare:onionshare:1.1
-
cpe:2.3:a:onionshare:onionshare:1.2
-
cpe:2.3:a:onionshare:onionshare:1.3
-
cpe:2.3:a:onionshare:onionshare:1.3.1