CVE-2023-22737

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 2022-12-09, every member of a Conversation can remove a Bot from a Conversation due to a missing permissions check. Only Conversation admins should be able to remove Bots. Regular Conversations are not allowed to do so. The issue is fixed in wire-server 2022-12-09 and is already deployed on all Wire managed services. On-premise instances of wire-server need to be updated to 2022-12-09/Chart 4.29.0, so that their backends are no longer affected. There are no known workarounds.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-280 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jan 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-227386.5vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different orga CVE-2023-227396.5Discourse is an open source platform for community discussion. Versions prior to 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.beta2 (tests-CVE-2023-227406.5Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to Alloca CVE-2023-227419.8Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. In affected versions Sofia-SIP **lacks bo CVE-2023-227425.9libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 doe CVE-2023-227437.3Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL a CVE-2023-227456.4tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2 CVE-2023-227467.5CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of t CVE-2023-227479.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p CVE-2023-227489.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p CVE-2023-227499.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p CVE-2023-22755.4The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to unauthorized access of data and addition of data du