CVE-2022-23605 Expired Ephemeral Messages not reliably removed in wire-webapp

What is CVE-2022-23605?

CVE-2022-23605 is a medium-severity vulnerability in wireapp wire-webapp, published on 4 Feb 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Wire webapp is a web client for the wire messaging protocol. In versions prior to 2022-01-27-production.0 expired ephemeral messages were not reliably removed from local chat history of Wire Webapp. In versions before 2022-01-27-production.0 ephemeral messages and assets might still be accessible through the local search functionality. Any attempt to view one of these message in the chat view will then trigger the deletion. This issue only affects locally stored messages. On premise instances of wire-webapp need to be updated to 2022-01-27-production.0, so that their users are no longer affected. There are no known workarounds for this issue.

Weakness: CWE-212

Which versions are affected by CVE-2022-23605?

It affects 1 product.

Products include Wire Wire-Webapp.

How do I fix CVE-2022-23605?

No fix has been published for CVE-2022-23605 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-23605 being exploited?

There is no known exploitation of CVE-2022-23605 in the wild and no public exploit code.

Other vulnerabilities in wireapp wire-webapp

• CVE-2022-29168 Cross Site Scripting in Wire Messages Critical 9.6
• CVE-2022-24799 Cross Site Scripting in Wire Webapp Critical 9.6
• CVE-2021-32683 XSS through createObjectURL High 8.8
• CVE-2021-21400 Entering code in App Lock modal sends input to conversation High 7.1
• CVE-2025-48066 wire-webapp has no database deletion on client logout Medium 6.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2w3m-ppfg-hg62.