wire-avs remote format string vulnerability
CVE-2023-48221

8.8HIGH

Key Information:

Vendor

wireapp

Status
wire-avs
Vendor
CVE Published:
20 November 2023

What is CVE-2023-48221?

The wire-avs component, providing Audio, Visual, and Signaling functionalities for the secure messaging platform Wire, was found to have a remote format string vulnerability before the release of versions 9.2.22 and 9.3.5. This flaw could allow attackers to execute arbitrary code or cause a denial of service. The vulnerability has been addressed in the mentioned versions, which are included in all Wire products. Please note that there are no available workarounds to mitigate this issue.

Affected Version(s)

wire-avs < 9.2.22 < 9.2.22

wire-avs >= 9.3.0, < 9.3.5 < 9.3.0, 9.3.5

References

https://github.com/wireapp/wire-avs/security/advisories/G...
x_refsource_CONFIRM
https://github.com/wireapp/wire-avs/commit/364c3326a1331a...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.