CVE-2022-24799 describes a cross-site scripting (XSS) vulnerability in wire-webapp, the web interface for the Wire messaging service, and connected wire-desktop clients. This flaw, rated Medium severity with a CVSS score of 6.1, allows an attacker to inject and execute arbitrary HTML and JavaScript code by sending a specially crafted message due to insufficient escaping in markdown code highlighting. Successful exploitation grants the attacker full control over the victim's user account. There is no evidence of active exploitation, nor are there public exploits or Metasploit modules available, though the vulnerability has garnered significant community discussion. The issue has been patched in wire-webapp 2022-03-30-production.0 and requires on-premise instances to update to specific docker tags or wire-server versions.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2016-07-29-17-00CPE matchmatch criteria | cpe:2.3:a:wire:wire-webapp:2016-07-29-17-00:*:*:*:*:*:*:* | ||
2016-08-04-15-44CPE matchmatch criteria | cpe:2.3:a:wire:wire-webapp:2016-08-04-15-44:*:*:*:*:*:*:* | ||
2016-08-23-09-31CPE matchmatch criteria | cpe:2.3:a:wire:wire-webapp:2016-08-23-09-31:*:*:*:*:*:*:* | ||
2016-08-24-10-10CPE matchmatch criteria | cpe:2.3:a:wire:wire-webapp:2016-08-24-10-10:*:*:*:*:*:*:* | ||
2016-08-29-14-54CPE matchmatch criteria | cpe:2.3:a:wire:wire-webapp:2016-08-29-14-54:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.