CVE-2022-29168

보통 6.1CVE-2022-29168 · Published 25/06/2022 · updated 17/06/2026

요약

CVE-2022-29168은(는) wire-webapp (wire)에 영향을 주는 보통 (CVSS 6.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.86%, 전체 취약점의 58.4%보다 높음.
아직 패치 버전 정보가 없습니다. 참고 자료의 공급업체 권고를 확인하세요.

Package	Affected versions	Patched versions
wire-webapp wire	`= 2016-07-29-17-00= 2016-08-04-15-44= 2016-08-23-09-31= 2016-08-24-10-10= 2016-08-29-14-54= 2016-09-08-15-38= 2016-09-19-14-01= 2016-09-28-14-58= 2016-10-11-15-34= 2016-10-18-08-10= 2016-10-25-08-17= 2016-10-26-18-58= 2016-11-03-16-09= 2016-11-08-15-06= 2016-12-01-12-57= 2016-12-13-15-12= 2017-01-23-12-12= 2017-02-01-14-49= 2017-02-17-10-10= 2017-02-24-13-06= 2017-03-08-17-32= 2017-03-14-15-05= 2017-03-21-11-00= 2017-03-27-17-10= 2017-03-28-14-23= 2017-04-05-16-58= 2017-04-07-09-42= 2017-04-19-12-31= 2017-04-20-15-54= 2017-05-03-10-29= 2017-05-19-16-10= 2017-05-26-08-16= 2017-05-26-12-03= 2017-06-01-10-02= 2017-06-07-15-03= 2017-06-07-18-05= 2017-06-22-12-18= 2017-06-28-15-13= 2017-07-06-12-44= 2017-07-06-15-48= 2017-07-18-12-50= 2017-08-03-15-19= 2017-08-04-09-04= 2017-08-04-15-01= 2017-08-08-15-09= 2017-08-24-10-57= 2017-08-31-14-21= 2017-09-26-07-18= 2017-09-26-13-00= 2017-10-09-08-42= 2017-10-19-10-45= 2017-10-25-07-08= 2017-11-07-08-50= 2017-11-10-10-41= 2017-12-04-10-23= 2017-12-04-13-34= 2017-12-07-11-13= 2017-12-20-12-48= 2018-01-24-18-11`	No fix yet

Description

Wire is a secure messaging application. Wire is vulnerable to arbitrary HTML and Javascript execution via insufficient escaping when rendering `@mentions` in the wire-webapp. If a user receives and views a malicious message, arbitrary code is injected and executed in the context of the victim allowing the attacker to fully control the user account. Wire-desktop clients that are connected to a vulnerable wire-webapp version are also vulnerable to this attack. The issue has been fixed in wire-webapp 2022-05-04-production.0 and is already deployed on all Wire managed services. On-premise instances of wire-webapp need to be updated to docker tag 2022-05-04-production.0-v0.29.7-0-a6f2ded or wire-server 2022-05-04 (chart/4.11.0) or later. No known workarounds exist.

References

wireapp/wire-webapp security advisory · Third Party Advisory

wire-webapp의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

wire-webapp

wire

= 2016-07-29-17-00= 2016-08-04-15-44= 2016-08-23-09-31= 2016-08-24-10-10= 2016-08-29-14-54= 2016-09-08-15-38= 2016-09-19-14-01= 2016-09-28-14-58= 2016-10-11-15-34= 2016-10-18-08-10= 2016-10-25-08-17= 2016-10-26-18-58= 2016-11-03-16-09= 2016-11-08-15-06= 2016-12-01-12-57= 2016-12-13-15-12= 2017-01-23-12-12= 2017-02-01-14-49= 2017-02-17-10-10= 2017-02-24-13-06= 2017-03-08-17-32= 2017-03-14-15-05= 2017-03-21-11-00= 2017-03-27-17-10= 2017-03-28-14-23= 2017-04-05-16-58= 2017-04-07-09-42= 2017-04-19-12-31= 2017-04-20-15-54= 2017-05-03-10-29= 2017-05-19-16-10= 2017-05-26-08-16= 2017-05-26-12-03= 2017-06-01-10-02= 2017-06-07-15-03= 2017-06-07-18-05= 2017-06-22-12-18= 2017-06-28-15-13= 2017-07-06-12-44= 2017-07-06-15-48= 2017-07-18-12-50= 2017-08-03-15-19= 2017-08-04-09-04= 2017-08-04-15-01= 2017-08-08-15-09= 2017-08-24-10-57= 2017-08-31-14-21= 2017-09-26-07-18= 2017-09-26-13-00= 2017-10-09-08-42= 2017-10-19-10-45= 2017-10-25-07-08= 2017-11-07-08-50= 2017-11-10-10-41= 2017-12-04-10-23= 2017-12-04-13-34= 2017-12-07-11-13= 2017-12-20-12-48= 2018-01-24-18-11

No fix yet

Description

wire-webapp의 다른 취약점

모두 보기 →