CVSS 6.1 · Medium EPSS 1,00%
Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada wire-webapp. Skor CVSS 3.1 6.1 (Medium) menurut NVD.
wire-webapp is the web application interface for the wire messaging service. Insufficient escaping in markdown “code highlighting” in the wire-webapp resulted in the possibility of injecting and executing arbitrary HTML code and thus also JavaScript. If a user receives and views such a malicious message, arbitrary code is injected and executed in the context of the victim. This allows the attacker to fully control the user account. Wire-desktop clients that are connected to a vulnerable wire-webapp version are also vulnerable to this attack. The issue has been fixed in wire-webapp 2022-03-30-production.0 and is already deployed on all Wire managed services. On-premise instances of wire-webapp need to be updated to docker tag 2022-03-30-production.0-v0.29.2-0-d144552 or wire-server 2022-03-30 (chart/4.8.0), so that their applications are no longer affected. There are no known workarounds for this issue. ### Patches * The issue has been fixed in wire-webapp **2022-03-30-production.0** and is already deployed on all Wire managed services. * On-premise instances of wire-webapp need to be updated to docker tag **2022-03-30-production.0-v0.29.2-0-d144552** or wire-server **2022-03-30 (chart/4.8.0)**, so that their applications are no longer affected. ### Workarounds * No workarounds known ### For more information If you have any questions or comments about this advisory feel free to email us at [vulnerability-report@wire.com](mailto:vulnerability-report@wire.com) ### Credits We thank [Posix](https://twitter.com/po6ix) for reporting this vulnerability
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| wire | wire-webapp | Versi 2016-07-29-17-00 |
| wire | wire-webapp | Versi 2016-08-04-15-44 |
| wire | wire-webapp | Versi 2016-08-23-09-31 |
| wire | wire-webapp | Versi 2016-08-24-10-10 |
| wire | wire-webapp | Versi 2016-08-29-14-54 |
| wire | wire-webapp | Versi 2016-09-08-15-38 |
| wire | wire-webapp | Versi 2016-09-19-14-01 |
| wire | wire-webapp | Versi 2016-09-28-14-58 |
| wire | wire-webapp | Versi 2016-10-11-15-34 |
| wire | wire-webapp | Versi 2016-10-18-08-10 |
| wire | wire-webapp | Versi 2016-10-25-08-17 |
| wire | wire-webapp | Versi 2016-10-26-18-58 |
| wire | wire-webapp | Versi 2016-11-03-16-09 |
| wire | wire-webapp | Versi 2016-11-08-15-06 |
| wire | wire-webapp | Versi 2016-12-01-12-57 |
| wire | wire-webapp | Versi 2016-12-13-15-12 |
| wire | wire-webapp | Versi 2017-01-23-12-12 |
| wire | wire-webapp | Versi 2017-02-01-14-49 |
| wire | wire-webapp | Versi 2017-02-17-10-10 |
| wire | wire-webapp | Versi 2017-02-24-13-06 |
| wire | wire-webapp | Versi 2017-03-08-17-32 |
| wire | wire-webapp | Versi 2017-03-14-15-05 |
| wire | wire-webapp | Versi 2017-03-21-11-00 |
| wire | wire-webapp | Versi 2017-03-27-17-10 |
| wire | wire-webapp | Versi 2017-03-28-14-23 |
| wire | wire-webapp | Versi 2017-04-05-16-58 |
| wire | wire-webapp | Versi 2017-04-07-09-42 |
| wire | wire-webapp | Versi 2017-04-19-12-31 |
| wire | wire-webapp | Versi 2017-04-20-15-54 |
| wire | wire-webapp | Versi 2017-05-03-10-29 |
| wire | wire-webapp | Versi 2017-05-19-16-10 |
| wire | wire-webapp | Versi 2017-05-26-08-16 |
| wire | wire-webapp | Versi 2017-05-26-12-03 |
| wire | wire-webapp | Versi 2017-06-01-10-02 |
| wire | wire-webapp | Versi 2017-06-07-15-03 |
| wire | wire-webapp | Versi 2017-06-07-18-05 |
| wire | wire-webapp | Versi 2017-06-22-12-18 |
| wire | wire-webapp | Versi 2017-06-28-15-13 |
| wire | wire-webapp | Versi 2017-07-06-12-44 |
| wire | wire-webapp | Versi 2017-07-06-15-48 |
| wire | wire-webapp | Versi 2017-07-18-12-50 |
| wire | wire-webapp | Versi 2017-08-03-15-19 |
| wire | wire-webapp | Versi 2017-08-04-09-04 |
| wire | wire-webapp | Versi 2017-08-04-15-01 |
| wire | wire-webapp | Versi 2017-08-08-15-09 |
| wire | wire-webapp | Versi 2017-08-24-10-57 |
| wire | wire-webapp | Versi 2017-08-31-14-21 |
| wire | wire-webapp | Versi 2017-09-26-07-18 |
| wire | wire-webapp | Versi 2017-09-26-13-00 |
| wire | wire-webapp | Versi 2017-10-09-08-42 |
| wire | wire-webapp | Versi 2017-10-19-10-45 |
| wire | wire-webapp | Versi 2017-10-25-07-08 |
| wire | wire-webapp | Versi 2017-11-07-08-50 |
| wire | wire-webapp | Versi 2017-11-10-10-41 |
| wire | wire-webapp | Versi 2017-12-04-10-23 |
| wire | wire-webapp | Versi 2017-12-04-13-34 |
| wire | wire-webapp | Versi 2017-12-07-11-13 |
| wire | wire-webapp | Versi 2017-12-20-12-48 |
| wire | wire-webapp | Versi 2018-01-24-18-11 |
| wire | wire-webapp | Versi 2018-02-01-10-26 |