CVE-2022-29168
Last modified
CVE-2022-29168 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Wire is a secure messaging application. Wire is vulnerable to arbitrary HTML and Javascript execution via insufficient escaping when rendering `@mentions` in the wire-webapp. EPSS estimates a 0.78% chance of exploitation in the next 30 days.
Description
Wire is a secure messaging application. Wire is vulnerable to arbitrary HTML and Javascript execution via insufficient escaping when rendering `@mentions` in the wire-webapp. If a user receives and views a malicious message, arbitrary code is injected and executed in the context of the victim allowing the attacker to fully control the user account. Wire-desktop clients that are connected to a vulnerable wire-webapp version are also vulnerable to this attack. The issue has been fixed in wire-webapp 2022-05-04-production.0 and is already deployed on all Wire managed services. On-premise instances of wire-webapp need to be updated to docker tag 2022-05-04-production.0-v0.29.7-0-a6f2ded or wire-server 2022-05-04 (chart/4.11.0) or later. No known workarounds exist.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Wire | Wire-Webapp | 2016-07-29-17-00 | — |
| Wire | Wire-Webapp | 2016-08-04-15-44 | — |
| Wire | Wire-Webapp | 2016-08-23-09-31 | — |
| Wire | Wire-Webapp | 2016-08-24-10-10 | — |
| Wire | Wire-Webapp | 2016-08-29-14-54 | — |
| Wire | Wire-Webapp | 2016-09-08-15-38 | — |
| Wire | Wire-Webapp | 2016-09-19-14-01 | — |
| Wire | Wire-Webapp | 2016-09-28-14-58 | — |
| Wire | Wire-Webapp | 2016-10-11-15-34 | — |
| Wire | Wire-Webapp | 2016-10-18-08-10 | — |
| Wire | Wire-Webapp | 2016-10-25-08-17 | — |
| Wire | Wire-Webapp | 2016-10-26-18-58 | — |
| Wire | Wire-Webapp | 2016-11-03-16-09 | — |
| Wire | Wire-Webapp | 2016-11-08-15-06 | — |
| Wire | Wire-Webapp | 2016-12-01-12-57 | — |
| Wire | Wire-Webapp | 2016-12-13-15-12 | — |
| Wire | Wire-Webapp | 2017-01-23-12-12 | — |
| Wire | Wire-Webapp | 2017-02-01-14-49 | — |
| Wire | Wire-Webapp | 2017-02-17-10-10 | — |
| Wire | Wire-Webapp | 2017-02-24-13-06 | — |
| Wire | Wire-Webapp | 2017-03-08-17-32 | — |
| Wire | Wire-Webapp | 2017-03-14-15-05 | — |
| Wire | Wire-Webapp | 2017-03-21-11-00 | — |
| Wire | Wire-Webapp | 2017-03-27-17-10 | — |
| Wire | Wire-Webapp | 2017-03-28-14-23 | — |
| Wire | Wire-Webapp | 2017-04-05-16-58 | — |
| Wire | Wire-Webapp | 2017-04-07-09-42 | — |
| Wire | Wire-Webapp | 2017-04-19-12-31 | — |
| Wire | Wire-Webapp | 2017-04-20-15-54 | — |
| Wire | Wire-Webapp | 2017-05-03-10-29 | — |
| Wire | Wire-Webapp | 2017-05-19-16-10 | — |
| Wire | Wire-Webapp | 2017-05-26-08-16 | — |
| Wire | Wire-Webapp | 2017-05-26-12-03 | — |
| Wire | Wire-Webapp | 2017-06-01-10-02 | — |
| Wire | Wire-Webapp | 2017-06-07-15-03 | — |
| Wire | Wire-Webapp | 2017-06-07-18-05 | — |
| Wire | Wire-Webapp | 2017-06-22-12-18 | — |
| Wire | Wire-Webapp | 2017-06-28-15-13 | — |
| Wire | Wire-Webapp | 2017-07-06-12-44 | — |
| Wire | Wire-Webapp | 2017-07-06-15-48 | — |
| Wire | Wire-Webapp | 2017-07-18-12-50 | — |
| Wire | Wire-Webapp | 2017-08-03-15-19 | — |
| Wire | Wire-Webapp | 2017-08-04-09-04 | — |
| Wire | Wire-Webapp | 2017-08-04-15-01 | — |
| Wire | Wire-Webapp | 2017-08-08-15-09 | — |
| Wire | Wire-Webapp | 2017-08-24-10-57 | — |
| Wire | Wire-Webapp | 2017-08-31-14-21 | — |
| Wire | Wire-Webapp | 2017-09-26-07-18 | — |
| Wire | Wire-Webapp | 2017-09-26-13-00 | — |
| Wire | Wire-Webapp | 2017-10-09-08-42 | — |
Showing 50 of 335 affected configurations. See NVD for the full list.
References
- https://github.com/wireapp/wire-webapp/security/advisories/GHSA-jgv3-4j56-fvh6Third Party Advisory
- https://github.com/wireapp/wire-webapp/security/advisories/GHSA-jgv3-4j56-fvh6Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-29168?
How severe is CVE-2022-29168?
How do I fix CVE-2022-29168?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-29162runc is a CLI tool for spawning and running containers on Li…7.8
- CVE-2022-29163Nextcloud Server is the file server software for Nextcloud, …4.3
- CVE-2022-29164Argo Workflows is an open source container-native workflow e…7.1
- CVE-2022-29165Argo CD is a declarative, GitOps continuous delivery tool fo…10
- CVE-2022-29166matrix-appservice-irc is a Node.js IRC bridge for Matrix. Th…8.8
- CVE-2022-29167Hawk is an HTTP authentication scheme providing mechanisms f…7.5
- CVE-2022-29169BigBlueButton is an open source web conferencing system. Ver…7.5
- CVE-2022-29170Grafana is an open-source platform for monitoring and observ…8.5
- CVE-2022-29171Sourcegraph is a fast and featureful code search and navigat…7.2
- CVE-2022-29172Auth0 is an authentication broker that supports both social …6.1
- CVE-2022-29173go-tuf is a Go implementation of The Update Framework (TUF).…8.8
- CVE-2022-29174countly-server is the server-side part of Countly, a product…8.1
Are you affected by CVE-2022-29168?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST