PT-2023-18678 · Wire · Wire-Server

Published 2023-01-27 · Updated 2023-02-08 · CVE-2023-22737

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions wire-server versions prior to 2022-12-09

Description The issue is related to a missing permissions check in wire-server, which provides back end services for Wire, a team communication and collaboration platform. Due to this, every member of a Conversation can remove a Bot from a Conversation, although only Conversation admins should have this ability. The issue is fixed in wire-server version 2022-12-09 and has been deployed on all Wire managed services.

Recommendations For wire-server versions prior to 2022-12-09, update to version 2022-12-09 or Chart 4.29.0 to resolve the issue. On-premise instances of wire-server should prioritize this update to prevent further exploitation. As a temporary workaround, consider restricting the ability to remove Bots from Conversations to only Conversation admins until the update can be applied.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-280

CWE-862

Related Identifiers

CVE-2023-22737

GHSA-XMJC-C6W3-PCP4

Affected Products

Wire-Server

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22737.json · Exploit
• https://github.com/wireapp/wire-server/pull/2870 · Patch
• https://github.com/wireapp/wire-server/commit/494a6881f5895d4ed9e5d011455242be0d5e6223 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-22737 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22737 · Vendor Advisory
• https://github.com/wireapp/wire-server/releases/tag/v2022-12-09 · Note
• https://github.com/wireapp/wire-server/security/advisories/GHSA-xmjc-c6w3-pcp4 · Note
• https://t.me/cibsecurity/57123 · Telegram Post