Wire
CVE-2023-48221
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Prior to versions 9.2.22 and 9.3.5, a remote format string vulnerability could potentially allow an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 9.2.22 & 9.3.5 and is already included on all Wire products. No known workarounds are available.
AnalysisAI
wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Technical ContextAI
This vulnerability is classified under CWE-134. wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Prior to versions 9.2.22 and 9.3.5, a remote format string vulnerability could potentially allow an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 9.2.22 & 9.3.5 and is already included on all Wire products. No known workarounds are available. Affected products include: Wire Audio\, Video\, And Signaling.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbi
Restund is an open source NAT traversal server. Rated critical severity (CVSS 9.6), this vulnerability is remotely explo
Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer
In Wire before 3.20.x, `shell.openExternal` was used without checking the URL. Rated high severity (CVSS 8.0), this vuln
The Wire application before 2018-03-07 for Android allows attackers to write to pathnames outside of the downloads direc
wire-webapp is the web version of Wire, an open-source messenger. Rated medium severity (CVSS 6.1), this vulnerability i
Wire-server is the backing server for the open source wire secure messaging application. Rated critical severity (CVSS 9
Wire is an open source secure messenger. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retrieved (for
Wire is an encrypted communication and collaboration platform. Rated high severity (CVSS 8.1), this vulnerability is rem
wire-server provides back end services for Wire, an open source messenger. Rated high severity (CVSS 8.1), this vulnerab
wire-server provides back end services for Wire, a team communication and collaboration platform. Rated medium severity
Same weakness CWE-134 – Use of Externally-Controlled Format String
View allShare
External POC / Exploit Code
Leaving vuln.today