CVE-2022-24799
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-24799
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24799.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-24799
- Related
- Published
- 2022-04-20T18:15:10Z
- Modified
- 2025-01-08T14:08:12.898412Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
wire-webapp is the web application interface for the wire messaging service. Insufficient escaping in markdown “code highlighting” in the wire-webapp resulted in the possibility of injecting and executing arbitrary HTML code and thus also JavaScript. If a user receives and views such a malicious message, arbitrary code is injected and executed in the context of the victim. This allows the attacker to fully control the user account. Wire-desktop clients that are connected to a vulnerable wire-webapp version are also vulnerable to this attack. The issue has been fixed in wire-webapp 2022-03-30-production.0 and is already deployed on all Wire managed services. On-premise instances of wire-webapp need to be updated to docker tag 2022-03-30-production.0-v0.29.2-0-d144552 or wire-server 2022-03-30 (chart/4.8.0), so that their applications are no longer affected. There are no known workarounds for this issue. ### Patches * The issue has been fixed in wire-webapp 2022-03-30-production.0 and is already deployed on all Wire managed services. * On-premise instances of wire-webapp need to be updated to docker tag 2022-03-30-production.0-v0.29.2-0-d144552 or wire-server 2022-03-30 (chart/4.8.0), so that their applications are no longer affected. ### Workarounds * No workarounds known ### For more information If you have any questions or comments about this advisory feel free to email us at vulnerability-report@wire.com ### Credits We thank Posix for reporting this vulnerability
- References
Affected packages
Git / github.com/wireapp/wire-webapp
Affected ranges
- Type
- GIT
- Repo
- https://github.com/wireapp/wire-webapp
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
Affected versions
Other
2016-07-29-17-00
2016-08-04-15-44
2016-08-23-09-31
2016-08-24-10-10
2016-08-29-14-54
2016-09-08-15-38
2016-09-19-14-01
2016-09-28-14-58
2016-10-11-15-34
2016-10-18-08-10
2016-10-25-08-17
2016-10-26-18-58
2016-11-03-16-09
2016-11-08-15-06
2016-12-01-12-57
2016-12-13-15-12
2017-01-23-12-12
2017-02-01-14-49
2017-02-17-10-10
2017-02-24-13-06
2017-03-08-17-32
2017-03-14-15-05
2017-03-21-11-00
2017-03-27-17-10
2017-03-28-14-23
2017-04-05-16-58
2017-04-07-09-42
2017-04-19-12-31
2017-04-20-15-54
2017-05-03-10-29
2017-05-19-16-10
2017-05-26-08-16
2017-05-26-12-03
2017-06-01-10-02
2017-06-07-15-03
2017-06-07-18-05
2017-06-22-12-18
2017-06-28-15-13
2017-07-06-12-44
2017-07-06-15-48
2017-07-18-12-50
2017-08-03-15-19
2017-08-04-09-04
2017-08-04-15-01
2017-08-08-15-09
2017-08-24-10-57
2017-08-31-14-21
2017-09-26-07-18
2017-09-26-13-00
2017-10-09-08-42
2017-10-19-10-45
2017-10-25-07-08
2017-11-07-08-50
2017-11-10-10-41
2017-12-04-10-23
2017-12-04-13-34
2017-12-07-11-13
2017-12-20-12-48
2018-01-24-18-11
2018-02-01-10-26
2018-02-16-07-54
2018-03-12-11-41
2018-04-06-07-28
2018-04-06-09-44
2018-04-09-10-16
2018-04-12-06-45
2018-04-12-11-12
2018-04-12-13-37
2018-04-24-14-58
2018-05-04-07-18
2018-05-24-15-49
2018-06-19-08-04
2018-07-03-08-25
2018-07-16-08-55
2018-07-16-14-05
2018-07-26-08-54
2018-08-06-08-03
2018-08-22-07-38
2018-08-31-06-54
2018-09-07-14-18
2018-09-28-11-46
2018-10-02-08-03
2018-10-15-08-14
2018-10-23-12-05
2018-11-05-11-21
2018-11-15-13-14
2018-11-30-11-03
2018-12-03-11-26
2018-12-04-14-24
2019-01-02-13-10
2019-01-08-13-20
2019-02-28-15-10
2019-02-11-staging.*
2019-02-11-staging.0
2019-02-11-staging.1
2019-02-11-staging.2
2019-02-13-staging.*
2019-02-13-staging.0
2019-02-18-staging.*
2019-02-18-staging.0
2019-02-27-staging.*
2019-02-27-staging.0
2019-02-28-staging.*
2019-02-28-staging.0
2019-03-05-staging.*
2019-03-05-staging.0
2019-03-07-staging.*
2019-03-07-staging.0
2019-03-11-staging.*
2019-03-11-staging.0
2019-03-13-staging.*
2019-03-13-staging.0
2019-03-20-staging.*
2019-03-20-staging.0
2019-03-25-staging.*
2019-03-25-staging.0
2019-03-25-staging.1
2019-03-28-staging.*
2019-03-28-staging.0
2019-04-08-staging.*
2019-04-08-staging.0
2019-04-11-staging.*
2019-04-11-staging.0
2019-04-18-staging.*
2019-04-18-staging.0
2019-04-23-staging.*
2019-04-23-staging.1
2019-04-25-staging.*
2019-04-25-staging.0
2019-04-29-staging.*
2019-04-29-staging.0
2019-05-14-staging.*
2019-05-14-staging.0
2019-05-15-staging.*
2019-05-15-staging.0
2019-05-31-staging.*
2019-05-31-staging.0
2019-06-04-staging.*
2019-06-04-staging.0
2019-06-20-staging.*
2019-06-20-staging.0
2019-06-24-staging.*
2019-06-24-staging.0
2019-06-25-staging.*
2019-06-25-staging.0
2019-06-26-staging.*
2019-06-26-staging.0
2019-07-01-staging.*
2019-07-01-staging.0
2019-07-30-staging.*
2019-07-30-staging.0
2019-08-01-staging.*
2019-08-01-staging.0
2019-08-14-staging.*
2019-08-14-staging.0
2019-08-19-staging.*
2019-08-19-staging.0
2019-08-21-production.*
2019-08-21-production.0
2019-08-22-production.*
2019-08-22-production.0
2019-08-22-staging.*
2019-08-22-staging.0
2019-08-27-staging.*
2019-08-27-staging.0
2019-09-02-production.*
2019-09-02-production.0
2019-09-05-staging.*
2019-09-05-staging.0
2019-09-09-staging.*
2019-09-09-staging.0
2019-09-12-staging.*
2019-09-12-staging.0
2019-09-13-staging.*
2019-09-13-staging.0
2019-09-17-production.*
2019-09-17-production.0
2019-09-18-staging.*
2019-09-18-staging.0
2019-09-23-staging.*
2019-09-23-staging.0
2019-09-24-production.*
2019-09-24-production.0
2019-10-07-staging.*
2019-10-07-staging.0
2019-10-07-staging.1
2019-10-08-staging.*
2019-10-08-staging.0
2019-10-10-staging.*
2019-10-10-staging.0
2019-10-10-staging.1
2019-10-14-staging.*
2019-10-14-staging.0
2019-10-16-production.*
2019-10-16-production.0
2019-10-16-production.1
2019-10-16-staging.*
2019-10-16-staging.0
2019-10-16-staging.1
2019-10-21-staging.*
2019-10-21-staging.0
2019-10-25-staging.*
2019-10-25-staging.0
2019-10-29-staging.*
2019-10-29-staging.0
2019-10-31-staging.*
2019-10-31-staging.0
2019-11-01-production.*
2019-11-01-production.0
2019-11-08-staging.*
2019-11-08-staging.0
2019-11-12-staging.*
2019-11-12-staging.0
2019-11-19-staging.*
2019-11-19-staging.0
2019-11-21-production.*
2019-11-21-production.0
2019-11-21-staging.*
2019-11-21-staging.0
2019-11-25-staging.*
2019-11-25-staging.0
2019-11-26-production.*
2019-11-26-production.0
2019-12-12-staging.*
2019-12-12-staging.0
2019-12-20-staging.*
2019-12-20-staging.0
2020-01-06-production.*
2020-01-06-production.0
2020-01-09-staging.*
2020-01-09-staging.0
2020-01-13-production.*
2020-01-13-production.0
2020-01-15-staging.*
2020-01-15-staging.0
2020-01-16-staging.*
2020-01-16-staging.0
2020-01-17-staging.*
2020-01-17-staging.0
2020-01-21-staging.*
2020-01-21-staging.0
2020-01-22-production.*
2020-01-22-production.0
2020-02-06-staging.*
2020-02-06-staging.0
2020-02-11-staging.*
2020-02-11-staging.0
2020-02-11-staging.1
2020-02-14-production.*
2020-02-14-production.0
2020-02-18-staging.*
2020-02-18-staging.0
2020-02-20-staging.*
2020-02-20-staging.0
2020-02-24-staging.*
2020-02-24-staging.0
2020-02-26-staging.*
2020-02-26-staging.0
2020-02-28-staging.*
2020-02-28-staging.0
2020-03-03-production.*
2020-03-03-production.0
2020-03-03-staging.*
2020-03-03-staging.0
2020-03-06-staging.*
2020-03-06-staging.0
2020-03-12-staging.*
2020-03-12-staging.0
2020-03-18-staging.*
2020-03-18-staging.0
2020-03-20-staging.*
2020-03-20-staging.0
2020-03-23-production.*
2020-03-23-production.0
2020-03-30-staging.*
2020-03-30-staging.0
2020-04-01-staging.*
2020-04-01-staging.0
2020-04-07-production.*
2020-04-07-production.0
2020-04-09-staging.*
2020-04-09-staging.0
2020-04-16-staging.*
2020-04-16-staging.0
2020-04-21-production.*
2020-04-21-production.0
2020-04-22-staging.*
2020-04-22-staging.0
2020-04-23-staging.*
2020-04-23-staging.0
2020-04-28-staging.*
2020-04-28-staging.0
2020-04-29-production.*
2020-04-29-production.0
2020-05-04-staging.*
2020-05-04-staging.0
2020-05-06-staging.*
2020-05-06-staging.0
2020-05-07-production.*
2020-05-07-production.0
2020-05-07-staging.*
2020-05-07-staging.0
2020-05-13-staging.*
2020-05-13-staging.0
2020-05-14-staging.*
2020-05-14-staging.0
2020-05-15-staging.*
2020-05-15-staging.0
2020-05-18-staging.*
2020-05-18-staging.0
2020-05-19-staging.*
2020-05-19-staging.0
2020-05-20-production.*
2020-05-20-production.0
2020-05-22-staging.*
2020-05-22-staging.0
2020-05-26-staging.*
2020-05-26-staging.0
2020-05-27-staging.*
2020-05-27-staging.0
2020-05-28-staging.*
2020-05-28-staging.0
2020-05-29-staging.*
2020-05-29-staging.0
2020-06-02-production.*
2020-06-02-production.0
2020-06-05-staging.*
2020-06-05-staging.0
2020-06-08-staging.*
2020-06-08-staging.0
2020-06-10-staging.*
2020-06-10-staging.0
2020-06-12-staging.*
2020-06-12-staging.0
2020-06-15-production.*
2020-06-15-production.0
2020-06-15-staging.*
2020-06-15-staging.0
2020-06-19-staging.*
2020-06-19-staging.0
2020-06-24-production.*
2020-06-24-production.0
2020-07-07-staging.*
2020-07-07-staging.0
2020-07-07-staging.1
2020-07-24-production.*
2020-07-24-production.0
2020-08-06-staging.*
2020-08-06-staging.0
2020-08-12-staging.*
2020-08-12-staging.0
2020-08-12-staging.1
2020-08-14-staging.*
2020-08-14-staging.0
2020-08-18-staging.*
2020-08-18-staging.0
2020-08-19-staging.*
2020-08-19-staging.0
2020-08-21-staging.*
2020-08-21-staging.0
2020-08-25-staging.*
2020-08-25-staging.0
2020-08-26-production.*
2020-08-26-production.0
2020-09-02-staging.*
2020-09-02-staging.0
2020-09-03-staging.*
2020-09-03-staging.0
2020-09-04-staging.*
2020-09-04-staging.0
2020-09-08-staging.*
2020-09-08-staging.0
2020-09-11-production.*
2020-09-11-production.0
2020-09-17-staging.*
2020-09-17-staging.0
2020-09-18-staging.*
2020-09-18-staging.0
2020-09-21-production.*
2020-09-21-production.0
2020-09-28-staging.*
2020-09-28-staging.0
2020-09-29-production.*
2020-09-29-production.0
2020-10-01-staging.*
2020-10-01-staging.0
2020-10-06-staging.*
2020-10-06-staging.0
2020-10-07-production.*
2020-10-07-production.0
2020-10-07-staging.*
2020-10-07-staging.0
2020-10-08-production.*
2020-10-08-production.0
2020-10-14-staging.*
2020-10-14-staging.0
2020-10-15-staging.*
2020-10-15-staging.0
2020-10-21-staging.*
2020-10-21-staging.0
2020-10-21-staging.1
2020-10-26-staging.*
2020-10-26-staging.0
2020-10-27-staging.*
2020-10-27-staging.0
2020-10-28-production.*
2020-10-28-production.0
2020-11-30-staging.*
2020-11-30-staging.0
2020-12-10-staging.*
2020-12-10-staging.0
2021-01-18-production.*
2021-01-18-production.0
2021-01-18-staging.*
2021-01-18-staging.1
2021-01-27-staging.*
2021-01-27-staging.0
2021-02-03-staging.*
2021-02-03-staging.0
2021-02-04-staging.*
2021-02-04-staging.0
2021-02-15-staging.*
2021-02-15-staging.0
2021-02-18-staging.*
2021-02-18-staging.0
2021-02-22-staging.*
2021-02-22-staging.1
2021-02-26-staging.*
2021-02-26-staging.0
2021-03-05-staging.*
2021-03-05-staging.0
2021-03-10-staging.*
2021-03-10-staging.0
2021-03-18-staging.*
2021-03-18-staging.0
2021-03-24-staging.*
2021-03-24-staging.0
2021-03-25-staging.*
2021-03-25-staging.0
2021-04-06-staging.*
2021-04-06-staging.0
2021-04-15-staging.*
2021-04-15-staging.0
2021-04-26-staging.*
2021-04-26-staging.0
2021-04-28-staging.*
2021-04-28-staging.0
2021-05-06-staging.*
2021-05-06-staging.0
2021-05-27-staging.*
2021-05-27-staging.0
2021-06-17-staging.*
2021-06-17-staging.0
2021-07-09-staging.*
2021-07-09-staging.0
2021-07-26-staging.*
2021-07-26-staging.0
2021-07-27-staging.*
2021-07-27-staging.0
2021-08-03-staging.*
2021-08-03-staging.0
2021-08-04-staging.*
2021-08-04-staging.0
2021-08-09-staging.*
2021-08-09-staging.0
2021-08-17-staging.*
2021-08-17-staging.0
2021-08-25-staging.*
2021-08-25-staging.0
2021-08-25-staging.1
2021-08-27-staging.*
2021-08-27-staging.0
2021-08-30-production.*
2021-08-30-production.0
2021-08-30-staging.*
2021-08-30-staging.0
2021-09-03-staging.*
2021-09-03-staging.0
2021-09-06-staging.*
2021-09-06-staging.0
2021-09-06-staging.1
2021-09-06-staging.2
2021-09-06-staging.3
2021-09-08-staging.*
2021-09-08-staging.0
2021-09-09-staging.*
2021-09-09-staging.0
2021-09-10-staging.*
2021-09-10-staging.0
2021-09-13-production.*
2021-09-13-production.0
2021-09-13-staging.*
2021-09-13-staging.0
2021-09-20-staging.*
2021-09-20-staging.0
2021-09-22-staging.*
2021-09-22-staging.0
2021-09-27-production.*
2021-09-27-production.0
2021-09-29-staging.*
2021-09-29-staging.0
2021-09-30-staging.*
2021-09-30-staging.0
2021-10-02-staging.*
2021-10-02-staging.0
2021-10-04-production.*
2021-10-04-production.0
2021-10-13-staging.*
2021-10-13-staging.0
2021-10-20-staging.*
2021-10-20-staging.0
2021-10-27-staging.*
2021-10-27-staging.0
2021-11-01-production.*
2021-11-01-production.0
2021-11-25-staging.*
2021-11-25-staging.0
2021-12-01-production.*
2021-12-01-production.0
2021-12-01-staging.*
2021-12-01-staging.0
2021-12-02-production.*
2021-12-02-production.0
2021-12-02-staging.*
2021-12-02-staging.0
2022-01-18-staging.*
2022-01-18-staging.0
2022-01-19-staging.*
2022-01-19-staging.0
2022-01-20-staging.*
2022-01-20-staging.0
2022-01-27-production.*
2022-01-27-production.0
2022-02-02-staging.*
2022-02-02-staging.0
2022-02-03-staging.*
2022-02-03-staging.0
2022-02-07-production.*
2022-02-07-production.0
2022-02-08-production.*
2022-02-08-production.0
2022-02-15-production.*
2022-02-15-production.0
2022-02-22-production.*
2022-02-22-production.0
v0.*
v0.2.0