Wire
CVE-2022-23625
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
1DescriptionNVD
Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malformed resource identifiers may render the iOS Wire Client completely unusable by causing it to repeatedly crash on launch. These malformed resource identifiers can be generated and sent between Wire users. The root cause lies in wireapp/wire-ios-transport, where code responsible for removing sensible tokens before logging may fail and lead to a crash (Swift exception) of the application. This causes undesirable behavior, however the (greater) Wire system is still functional. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
AnalysisAI
Wire-ios is a messaging application using the wire protocol on apple's ios platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Technical ContextAI
This vulnerability is classified under CWE-755. Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malformed resource identifiers may render the iOS Wire Client completely unusable by causing it to repeatedly crash on launch. These malformed resource identifiers can be generated and sent between Wire users. The root cause lies in wireapp/wire-ios-transport, where code responsible for removing sensible tokens before logging may fail and lead to a crash (Swift exception) of the application. This causes undesirable behavior, however the (greater) Wire system is still functional. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue. Affected products include: Wire, Wire Wire-Ios-Transport. Version information: prior to 3.95.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbi
Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer
In Wire before 3.20.x, `shell.openExternal` was used without checking the URL. Rated high severity (CVSS 8.0), this vuln
The Wire application before 2018-03-07 for Android allows attackers to write to pathnames outside of the downloads direc
Wire is an open source secure messenger. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retrieved (for
wire-server provides back end services for Wire, a team communication and collaboration platform. Rated medium severity
wire-ios is an iOS client for the Wire secure messaging application. Rated medium severity (CVSS 6.5), this vulnerabilit
wire-ios is the iOS version of Wire, an open-source secure messaging app. Rated medium severity (CVSS 6.5), this vulnera
wire-ios is the iOS version of Wire, an open-source secure messaging app. Rated medium severity (CVSS 6.5), this vulnera
Wire is an open source secure messenger. Rated medium severity (CVSS 4.6), this vulnerability is no authentication requi
Wire is a collaboration platform. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low atta
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today