CVE-2022-29168
Cross Site Scripting in Wire Messages
MEDIUM
6.1
CVSS Score
Published: June 25, 2022 at 07:05 AM UTC
Updated: June 17, 2026 at 04:39 AM UTC
2 products affected across 2 vendorsWire WebappWire Webapp
Using wire-webapp by wireapp?
Get instant alerts when new vulnerabilities affect wire-webapp - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM6.1
Exploit prediction
EPSS 0.9%
SSVC
No known exploit
Description
Wire is a secure messaging application. Wire is vulnerable to arbitrary HTML and Javascript execution via insufficient escaping when rendering `@mentions` in the wire-webapp. If a user receives and views a malicious message, arbitrary code is injected and executed in the context of the victim allowing the attacker to fully control the user account. Wire-desktop clients that are connected to a vulnerable wire-webapp version are also vulnerable to this attack. The issue has been fixed in wire-webapp 2022-05-04-production.0 and is already deployed on all Wire managed services. On-premise instances of wire-webapp need to be updated to docker tag 2022-05-04-production.0-v0.29.7-0-a6f2ded or wire-server 2022-05-04 (chart/4.11.0) or later. No known workarounds exist.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
2016-10-11-15-342016-10-18-8-102016-10-25-8-172016-10-26-18-582016-11-3-16-92016-11-8-15-62016-12-1-12-572016-12-13-15-122016-7-29-17-02016-8-23-9-312016-8-24-10-102016-8-29-14-542016-8-4-15-442016-9-19-14-12016-9-28-14-582016-9-8-15-382017-1-23-12-122017-10-19-10-452017-10-25-7-82017-10-9-8-422017-11-10-10-412017-11-7-8-502017-12-20-12-482017-12-4-10-232017-12-4-13-342017-12-7-11-132017-2-1-14-492017-2-17-10-102017-2-24-13-62017-3-14-15-52017-3-21-11-02017-3-27-17-102017-3-28-14-232017-3-8-17-322017-4-19-12-312017-4-20-15-542017-4-5-16-582017-4-7-9-422017-5-19-16-102017-5-26-12-32017-5-26-8-162017-5-3-10-292017-6-1-10-22017-6-22-12-182017-6-28-15-132017-6-7-15-32017-6-7-18-52017-7-18-12-502017-7-6-12-442017-7-6-15-482017-8-24-10-572017-8-3-15-192017-8-31-14-212017-8-4-15-12017-8-4-9-42017-8-8-15-92017-9-26-13-02017-9-26-7-182018-1-24-18-112018-10-15-8-142018-10-2-8-32018-10-23-12-52018-11-15-13-142018-11-30-11-32018-11-5-11-212018-12-3-11-262018-12-4-14-242018-2-1-10-262018-2-16-7-542018-3-12-11-412018-4-12-11-122018-4-12-13-372018-4-12-6-452018-4-24-14-582018-4-6-7-282018-4-6-9-442018-4-9-10-162018-5-24-15-492018-5-4-7-182018-6-19-8-42018-7-16-14-52018-7-16-8-552018-7-26-8-542018-7-3-8-252018-8-22-7-382018-8-31-6-542018-8-6-8-32018-9-28-11-462018-9-7-14-182019-1-17-15-82019-1-2-13-102019-1-8-13-202019-10-10 staging02019-10-10 staging12019-10-14 staging02019-10-16 production02019-10-16 production12019-10-16 staging02019-10-16 staging12019-10-21 staging02019-10-25 staging02019-10-29 staging02019-10-31 staging02019-10-7 staging02019-10-7 staging12019-10-8 staging02019-11-1 production02019-11-12 staging02019-11-19 staging02019-11-21 production02019-11-21 staging02019-11-25 staging02019-11-26 production02019-11-8 staging02019-12-12 staging02019-12-20 staging02019-2-11 staging02019-2-11 staging12019-2-11 staging22019-2-13 staging02019-2-18 staging02019-2-18-11-262019-2-27 staging02019-2-28 staging02019-2-28 staging12019-2-28-15-102019-2-28-15-112019-3-11 staging02019-3-13 staging02019-3-13 staging12019-3-14-11-52019-3-18-12-582019-3-20 staging02019-3-25 staging02019-3-25 staging12019-3-28 staging02019-3-28 staging12019-3-29-9-382019-3-5 staging02019-3-7 staging02019-4-10-10-552019-4-11 staging02019-4-18 staging02019-4-23 staging12019-4-23-10-512019-4-25 staging02019-4-29 staging02019-4-8 staging02019-5-14 staging02019-5-15 staging02019-5-162019-5-16-9-262019-5-31 staging02019-5-31-8-182019-5-9-9-362019-6-20 staging02019-6-24 staging02019-6-25 staging02019-6-26 staging02019-6-4 staging02019-6-6-12-312019-7-1 staging02019-7-11-13-182019-7-2-12-292019-7-30 staging02019-8-1 staging02019-8-14 staging02019-8-19 staging02019-8-21 production02019-8-22 production02019-8-22 staging02019-8-27 staging02019-9-12 staging02019-9-13 staging02019-9-17 production02019-9-18 staging02019-9-2 production02019-9-23 staging02019-9-24 production02019-9-5 staging02019-9-9 staging02020-1-13 production02020-1-15 staging02020-1-16 staging02020-1-17 staging02020-1-21 staging02020-1-22 production02020-1-6 production02020-1-9 staging02020-10-1 staging02020-10-14 staging02020-10-15 staging02020-10-21 staging02020-10-21 staging12020-10-26 staging02020-10-27 staging02020-10-28 production02020-10-6 staging02020-10-7 production02020-10-7 staging02020-10-8 production02020-11-30 production02020-11-30 staging02020-11-9 production02020-12-10 staging02020-12-14 production02020-2-11 staging02020-2-11 staging12020-2-14 production02020-2-18 staging02020-2-20 staging02020-2-24 staging02020-2-26 staging02020-2-28 staging02020-2-6 staging02020-3-12 staging02020-3-18 staging02020-3-20 staging02020-3-23 production02020-3-3 production02020-3-3 staging02020-3-30 staging02020-3-6 staging02020-4-1 staging02020-4-16 staging02020-4-21 production02020-4-22 staging02020-4-23 staging02020-4-28 staging02020-4-29 production02020-4-7 production02020-4-9 staging02020-5-13 staging02020-5-14 staging02020-5-15 staging02020-5-18 staging02020-5-19 staging02020-5-20 production02020-5-22 staging02020-5-26 staging02020-5-27 staging02020-5-28 staging02020-5-29 staging02020-5-4 staging02020-5-6 staging02020-5-7 production02020-5-7 staging02020-6-10 staging02020-6-12 staging02020-6-15 production02020-6-15 staging02020-6-19 staging02020-6-2 production02020-6-24 production02020-6-29 staging02020-6-5 staging02020-6-8 staging02020-7-13 staging02020-7-16 staging02020-7-24 production02020-7-24 staging02020-7-24 staging12020-7-7 staging02020-7-7 staging12020-8-12 staging02020-8-12 staging12020-8-14 staging02020-8-18 staging02020-8-19 staging02020-8-21 staging02020-8-25 staging02020-8-26 production02020-8-6 staging02020-9-11 production02020-9-17 staging02020-9-18 staging02020-9-2 staging02020-9-21 production02020-9-28 staging02020-9-29 production02020-9-3 staging02020-9-4 staging02020-9-8 staging02021-1-18 production02021-1-18 staging12021-1-27 staging02021-10-13 staging02021-10-2 staging02021-10-20 staging02021-10-27 staging02021-10-4 production02021-11-1 production02021-11-25 staging02021-12-1 production02021-12-1 staging02021-12-2 production02021-2-15 staging02021-2-17 production02021-2-18 staging02021-2-2 production02021-2-22 staging12021-2-26 staging02021-2-3 staging02021-2-4 staging02021-3-10 staging02021-3-15 production02021-3-18 staging02021-3-24 staging02021-3-25 staging02021-3-4 production02021-3-5 staging02021-4-1 production02021-4-15 staging02021-4-26 staging02021-4-28 staging02021-4-6 staging02021-5-10 production02021-5-27 staging02021-5-6 staging02021-6-1 production02021-6-17 staging02021-7-26 staging02021-7-27 staging02021-7-9 staging02021-8-17 staging02021-8-25 staging02021-8-25 staging12021-8-27 staging02021-8-3 staging02021-8-30 production02021-8-30 staging02021-8-4 staging02021-8-9 staging02021-9-10 staging02021-9-13 production02021-9-13 staging02021-9-20 staging02021-9-22 staging02021-9-27 production02021-9-29 staging02021-9-3 staging02021-9-30 staging02021-9-6 staging02021-9-6 staging12021-9-6 staging22021-9-6 staging32021-9-8 staging02021-9-9 staging02022-1-18 staging02022-1-19 staging02022-1-20 staging02022-1-27 production02022-2-15 production02022-2-17 staging02022-2-2 staging02022-2-22 production02022-2-3 staging02022-2-7 production02022-2-8 production02022-3-23 staging02022-3-28 staging02022-3-29 staging02022-3-30 production02022-3-31 staging02022-4-13 staging02022-4-19 staging02022-4-21 production0
v < 022-05-04-production.0v < 2022-05-04-production.0-v0.29.7-0-a6f2ded
Affected range stops below 022-05-04-production.0, so it looks safe — our inference, not a vendor statement
Affected range stops below 2022-05-04-production.0-v0.29.7-0-a6f2ded, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.
References (1)
x_refsource_CONFIRMThird Party Advisory
Source: [email protected]
https://github.com/wireapp/wire-webapp/security/advisories/GHSA-jgv3-4j56-fvh6SSVC — Action Prioritization
SSVCNo known exploitNot automatableTotal impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- REQUIRED
- Scope
- CHANGED
- Confidentiality
- LOW
- Integrity
- LOW
- Availability
- NONE
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-79CWE-80
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card