PT-2020-14319 · Wire · Wire

Benjamin Altpeter · Published 2020-10-16 · Updated 2020-10-28 · CVE-2020-15258

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wire versions prior to 3.20.x

Description The issue allows an attacker to execute code on the victim's machine by sending messages containing links with arbitrary protocols. The victim must interact with the link and sees the URL that is opened. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 3.20.x, update to Wire 3.20.x to resolve the issue. As a temporary workaround, consider avoiding interaction with links from untrusted sources until the update is applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-15258

GHSA-5GPX-9976-GGPM

Affected Products

Wire

References · 5

• 🔥 https://github.com/wireapp/wire-desktop/security/advisories/GHSA-5gpx-9976-ggpm · Exploit
• 🔥 https://benjamin-altpeter.de/shell-openexternal-dangers · Exploit
• https://github.com/wireapp/wire-desktop/commit/b3705fffa75a03f055530f55a754face5ac0623b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15258 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15258 · Vendor Advisory