PT-2025-22525 · Unknown · Wire-Webapp

Sanojwr · Publicado 2025-05-22 · Atualizado 2025-05-30 · CVE-2025-48066

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Média

Vetor base

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions wire-webapp versions prior to 2025-05-14-production.0

Description A regression issue in the function to delete local data causes the client's local database not to be deleted upon user logout, even when instructed to do so. This affects both temporary clients and regular clients attempting to delete personal information and conversations. Access to the machine is required to access the data, and if encryption-at-rest is used, cryptographic material cannot be exported.

Recommendations For versions prior to 2025-05-14-production.0, manually delete the database on devices where the option "This is a public computer" was used prior to login or a logout with the request to delete local data has happened before. Update to wire-webapp version 2025-05-14-production.0 to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-212

CWE-226

Identificadores relacionados

CVE-2025-48066

GHSA-QC6C-2HH8-QFH8

Produtos afetados

Wire-Webapp

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48066.json · Exploit
• https://github.com/wireapp/wire-webapp/security/advisories/GHSA-qc6c-2hh8-qfh8 · Aviso do Fabricante
• https://github.com/wireapp/wire-webapp/commit/4c0ed5f1e9e0fcfceedf3c29034defce6e1fea77 · Correção
• https://twitter.com/dailycve/status/1928279133756281042 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-48066 · Nota de Segurança
• https://twitter.com/CVEnew/status/1925610249018392729 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-48066 · Aviso do Fabricante