vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2022-24799

Cross Site Scripting in Wire Webapp

MEDIUM
6.1
CVSS Score
Published: April 20, 2022 at 05:55 PM UTC
Updated: June 17, 2026 at 04:32 AM UTC
2 products affected across 2 vendorsWire WebappWire Webapp

Using wire-webapp by wireapp?

Get instant alerts when new vulnerabilities affect wire-webapp - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.1
Exploit prediction
EPSS 1.0%
SSVC
No known exploit

Description

wire-webapp is the web application interface for the wire messaging service. Insufficient escaping in markdown “code highlighting” in the wire-webapp resulted in the possibility of injecting and executing arbitrary HTML code and thus also JavaScript. If a user receives and views such a malicious message, arbitrary code is injected and executed in the context of the victim. This allows the attacker to fully control the user account. Wire-desktop clients that are connected to a vulnerable wire-webapp version are also vulnerable to this attack. The issue has been fixed in wire-webapp 2022-03-30-production.0 and is already deployed on all Wire managed services. On-premise instances of wire-webapp need to be updated to docker tag 2022-03-30-production.0-v0.29.2-0-d144552 or wire-server 2022-03-30 (chart/4.8.0), so that their applications are no longer affected. There are no known workarounds for this issue. ### Patches * The issue has been fixed in wire-webapp **2022-03-30-production.0** and is already deployed on all Wire managed services. * On-premise instances of wire-webapp need to be updated to docker tag **2022-03-30-production.0-v0.29.2-0-d144552** or wire-server **2022-03-30 (chart/4.8.0)**, so that their applications are no longer affected. ### Workarounds * No workarounds known ### For more information If you have any questions or comments about this advisory feel free to email us at [[email protected]](mailto:[email protected]) ### Credits We thank [Posix](https://twitter.com/po6ix) for reporting this vulnerability

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Wire Webapp· Wire
95%
2016-10-11-15-342016-10-18-8-102016-10-25-8-172016-10-26-18-582016-11-3-16-92016-11-8-15-62016-12-1-12-572016-12-13-15-122016-7-29-17-02016-8-23-9-312016-8-24-10-102016-8-29-14-542016-8-4-15-442016-9-19-14-12016-9-28-14-582016-9-8-15-382017-1-23-12-122017-10-19-10-452017-10-25-7-82017-10-9-8-422017-11-10-10-412017-11-7-8-502017-12-20-12-482017-12-4-10-232017-12-4-13-342017-12-7-11-132017-2-1-14-492017-2-17-10-102017-2-24-13-62017-3-14-15-52017-3-21-11-02017-3-27-17-102017-3-28-14-232017-3-8-17-322017-4-19-12-312017-4-20-15-542017-4-5-16-582017-4-7-9-422017-5-19-16-102017-5-26-12-32017-5-26-8-162017-5-3-10-292017-6-1-10-22017-6-22-12-182017-6-28-15-132017-6-7-15-32017-6-7-18-52017-7-18-12-502017-7-6-12-442017-7-6-15-482017-8-24-10-572017-8-3-15-192017-8-31-14-212017-8-4-15-12017-8-4-9-42017-8-8-15-92017-9-26-13-02017-9-26-7-182018-1-24-18-112018-10-15-8-142018-10-2-8-32018-10-23-12-52018-11-15-13-142018-11-30-11-32018-11-5-11-212018-12-3-11-262018-12-4-14-242018-2-1-10-262018-2-16-7-542018-3-12-11-412018-4-12-11-122018-4-12-13-372018-4-12-6-452018-4-24-14-582018-4-6-7-282018-4-6-9-442018-4-9-10-162018-5-24-15-492018-5-4-7-182018-6-19-8-42018-7-16-14-52018-7-16-8-552018-7-26-8-542018-7-3-8-252018-8-22-7-382018-8-31-6-542018-8-6-8-32018-9-28-11-462018-9-7-14-182019-1-17-15-82019-1-2-13-102019-1-8-13-202019-10-10 staging02019-10-10 staging12019-10-14 staging02019-10-16 production02019-10-16 production12019-10-16 staging02019-10-16 staging12019-10-21 staging02019-10-25 staging02019-10-29 staging02019-10-31 staging02019-10-7 staging02019-10-7 staging12019-10-8 staging02019-11-1 production02019-11-12 staging02019-11-19 staging02019-11-21 production02019-11-21 staging02019-11-25 staging02019-11-26 production02019-11-8 staging02019-12-12 staging02019-12-20 staging02019-2-11 staging02019-2-11 staging12019-2-11 staging22019-2-13 staging02019-2-18 staging02019-2-18-11-262019-2-27 staging02019-2-28 staging02019-2-28 staging12019-2-28-15-102019-2-28-15-112019-3-11 staging02019-3-13 staging02019-3-13 staging12019-3-14-11-52019-3-18-12-582019-3-20 staging02019-3-25 staging02019-3-25 staging12019-3-28 staging02019-3-28 staging12019-3-29-9-382019-3-5 staging02019-3-7 staging02019-4-10-10-552019-4-11 staging02019-4-18 staging02019-4-23 staging12019-4-23-10-512019-4-25 staging02019-4-29 staging02019-4-8 staging02019-5-14 staging02019-5-15 staging02019-5-162019-5-16-9-262019-5-31 staging02019-5-31-8-182019-5-9-9-362019-6-20 staging02019-6-24 staging02019-6-25 staging02019-6-26 staging02019-6-4 staging02019-6-6-12-312019-7-1 staging02019-7-11-13-182019-7-2-12-292019-7-30 staging02019-8-1 staging02019-8-14 staging02019-8-19 staging02019-8-21 production02019-8-22 production02019-8-22 staging02019-8-27 staging02019-9-12 staging02019-9-13 staging02019-9-17 production02019-9-18 staging02019-9-2 production02019-9-23 staging02019-9-24 production02019-9-5 staging02019-9-9 staging02020-1-13 production02020-1-15 staging02020-1-16 staging02020-1-17 staging02020-1-21 staging02020-1-22 production02020-1-6 production02020-1-9 staging02020-10-1 staging02020-10-14 staging02020-10-15 staging02020-10-21 staging02020-10-21 staging12020-10-26 staging02020-10-27 staging02020-10-28 production02020-10-6 staging02020-10-7 production02020-10-7 staging02020-10-8 production02020-11-30 production02020-11-30 staging02020-11-9 production02020-12-10 staging02020-12-14 production02020-2-11 staging02020-2-11 staging12020-2-14 production02020-2-18 staging02020-2-20 staging02020-2-24 staging02020-2-26 staging02020-2-28 staging02020-2-6 staging02020-3-12 staging02020-3-18 staging02020-3-20 staging02020-3-23 production02020-3-3 production02020-3-3 staging02020-3-30 staging02020-3-6 staging02020-4-1 staging02020-4-16 staging02020-4-21 production02020-4-22 staging02020-4-23 staging02020-4-28 staging02020-4-29 production02020-4-7 production02020-4-9 staging02020-5-13 staging02020-5-14 staging02020-5-15 staging02020-5-18 staging02020-5-19 staging02020-5-20 production02020-5-22 staging02020-5-26 staging02020-5-27 staging02020-5-28 staging02020-5-29 staging02020-5-4 staging02020-5-6 staging02020-5-7 production02020-5-7 staging02020-6-10 staging02020-6-12 staging02020-6-15 production02020-6-15 staging02020-6-19 staging02020-6-2 production02020-6-24 production02020-6-29 staging02020-6-5 staging02020-6-8 staging02020-7-13 staging02020-7-16 staging02020-7-24 production02020-7-24 staging02020-7-24 staging12020-7-7 staging02020-7-7 staging12020-8-12 staging02020-8-12 staging12020-8-14 staging02020-8-18 staging02020-8-19 staging02020-8-21 staging02020-8-25 staging02020-8-26 production02020-8-6 staging02020-9-11 production02020-9-17 staging02020-9-18 staging02020-9-2 staging02020-9-21 production02020-9-28 staging02020-9-29 production02020-9-3 staging02020-9-4 staging02020-9-8 staging02021-1-18 production02021-1-18 staging12021-1-27 staging02021-10-13 staging02021-10-2 staging02021-10-20 staging02021-10-27 staging02021-10-4 production02021-11-1 production02021-11-25 staging02021-12-1 production02021-12-1 staging02021-12-2 production02021-2-15 staging02021-2-17 production02021-2-18 staging02021-2-2 production02021-2-22 staging12021-2-26 staging02021-2-3 staging02021-2-4 staging02021-3-10 staging02021-3-15 production02021-3-18 staging02021-3-24 staging02021-3-25 staging02021-3-4 production02021-3-5 staging02021-4-1 production02021-4-15 staging02021-4-26 staging02021-4-28 staging02021-4-6 staging02021-5-10 production02021-5-27 staging02021-5-6 staging02021-6-1 production02021-6-17 staging02021-7-26 staging02021-7-27 staging02021-7-9 staging02021-8-17 staging02021-8-25 staging02021-8-25 staging12021-8-27 staging02021-8-3 staging02021-8-30 production02021-8-30 staging02021-8-4 staging02021-8-9 staging02021-9-10 staging02021-9-13 production02021-9-13 staging02021-9-20 staging02021-9-22 staging02021-9-27 production02021-9-29 staging02021-9-3 staging02021-9-30 staging02021-9-6 staging02021-9-6 staging12021-9-6 staging22021-9-6 staging32021-9-8 staging02021-9-9 staging02022-1-18 staging02022-1-19 staging02022-1-20 staging02022-1-27 production02022-2-15 production02022-2-17 staging02022-2-2 staging02022-2-22 production02022-2-3 staging02022-2-7 production02022-2-8 production02022-3-23 staging02022-3-28 staging02022-3-29 staging0
Wire Webapp· Wireapp
60%
v < 2022-03-30-production.0
Affected range stops below 2022-03-30-production.0, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (3)

x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/wireapp/wire-webapp/commit/d14455252a949dc83f36d45e2babbdd9328af2a4
x_refsource_MISCThird Party Advisory
Source: [email protected]
https://github.com/wireapp/wire-webapp/releases/tag/2022-03-30-production.0
x_refsource_CONFIRMThird Party Advisory
Source: [email protected]
https://github.com/wireapp/wire-webapp/security/advisories/GHSA-5568-rfh8-vmhq

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.1MEDIUM[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card