PT-2023-13724 · Wire · Wire

Published 2023-01-27 · Updated 2023-02-07 · CVE-2022-39380

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Wire web-app versions prior to 2022-11-02

Description The issue is related to Improper Handling of Exceptional Conditions in the Wire web-app. Certain combinations of Markdown formatting can trigger an unhandled error in the conversion to HTML representation, making it impossible to display the affected chat history. Other conversations are not affected. The error occurs when attempting to retrieve messages from the conversation history and the malformed message is part of the result.

Recommendations For on-premise instances of wire-webapp, update to docker tag 2022-11-02-production.0-v0.31.9-0-337e400 or wire-server 2022-11-03 (chart/4.26.0) to resolve the issue. As a temporary workaround, use an iOS or Android client and delete the corresponding message from the history, or write 30 or more messages into the affected conversation to prevent the client from further rendering of the corresponding message.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2022-39380

GHSA-V5MF-358Q-W7M4

Affected Products

Wire

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39380.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-39380 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39380 · Vendor Advisory
• https://github.com/wireapp/wire-webapp/security/advisories/GHSA-v5mf-358q-w7m4 · Note
• https://t.me/cvenotify/43811 · Telegram Post