PT-2023-13724 · Wire · Wire

CVE-2022-39380 · Publicado 2023-01-27 · Atualizado 2023-02-07

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Wire web-app versions prior to 2022-11-02

Description The issue is related to Improper Handling of Exceptional Conditions in the Wire web-app. Certain combinations of Markdown formatting can trigger an unhandled error in the conversion to HTML representation, making it impossible to display the affected chat history. Other conversations are not affected. The error occurs when attempting to retrieve messages from the conversation history and the malformed message is part of the result.

Recommendations For on-premise instances of wire-webapp, update to docker tag 2022-11-02-production.0-v0.31.9-0-337e400 or wire-server 2022-11-03 (chart/4.26.0) to resolve the issue. As a temporary workaround, use an iOS or Android client and delete the corresponding message from the history, or write 30 or more messages into the affected conversation to prevent the client from further rendering of the corresponding message.

Exploit

Correção

Improper Handling of Exceptional Conditions

Enumeração de Fraquezas

CWE-755

Identificadores relacionados

CVE-2022-39380

GHSA-V5MF-358Q-W7M4

Produtos afetados

Wire

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39380.json · Exploit
• https://github.com/wireapp/wire-webapp/security/advisories/GHSA-v5mf-358q-w7m4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-39380 · Nota de Segurança
• https://t.me/cvenotify/43811 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-39380 · Aviso do Fabricante