{"id":"CVE-2023-22737","summary":"wire-server vulnerable to unauthorized removal of Bots from Conversations","details":"wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 2022-12-09, every member of a Conversation can remove a Bot from a Conversation due to a missing permissions check. Only Conversation admins should be able to remove Bots. Regular Conversations are not allowed to do so. The issue is fixed in wire-server 2022-12-09 and is already deployed on all Wire managed services. On-premise instances of wire-server need to be updated to 2022-12-09/Chart 4.29.0, so that their backends are no longer affected. There are no known workarounds.","aliases":["GHSA-xmjc-c6w3-pcp4"],"modified":"2026-07-15T01:49:13.639612910Z","published":"2023-01-27T23:14:33.913Z","database_specific":{"cwe_ids":["CWE-280","CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22737.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/wireapp/wire-server/releases/tag/v2022-12-09"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22737.json"},{"type":"ADVISORY","url":"https://github.com/wireapp/wire-server/security/advisories/GHSA-xmjc-c6w3-pcp4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22737"},{"type":"FIX","url":"https://github.com/wireapp/wire-server/commit/494a6881f5895d4ed9e5d011455242be0d5e6223"},{"type":"FIX","url":"https://github.com/wireapp/wire-server/pull/2870"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wireapp/wire-server","events":[{"introduced":"0"},{"fixed":"494a6881f5895d4ed9e5d011455242be0d5e6223"},{"fixed":"6ed493a4ab3c676eaf29ff0e44e5bf816b0bdc9c"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2022-12-09"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v2022-11-03","chart/4.26.0","v2022-10-04","image/4.25.0","chart/4.25.0","v2022-09-27","image/4.24.0","chart/4.24.0","v2022-09-01","image/4.23.0","chart/4.23.0","v2022-08-16","image/4.22.0","chart/4.22.0","v2022-07-19","image/4.21.0","deb/4.21.0","chart/4.21.0","v2022-07-12","image/4.20.0","image/4.19.0","deb/4.20.0","deb/4.19.0","chart/4.20.0","chart/4.19.0","v2022-07-05","image/4.18.0","deb/4.18.0","chart/4.18.0","v2022-06-14","image/4.17.0","image/4.16.0","image/4.15.0","image/4.14.0","deb/4.17.0","deb/4.16.0","deb/4.15.0","deb/4.14.0","chart/4.17.0","chart/4.16.0","chart/4.15.0","chart/4.14.0","v2022-05-04","image/4.11.0","deb/4.11.0","chart/4.11.0","v2022-06-08","image/4.13.0","deb/4.13.0","chart/4.13.0","v2022-05-18","image/4.12.0","deb/4.12.0","chart/4.12.0","v2022-04-25","image/4.10.0","deb/4.10.0","chart/4.10.0","v2022-04-04","image/4.9.0","deb/4.9.0","chart/4.9.0","v2022-03-30","image/4.8.0","deb/4.8.0","chart/4.8.0","v2022-03-18","image/4.7.0","deb/4.7.0","chart/4.7.0","v2022-03-09","image/4.6.0","deb/4.6.0","chart/4.6.0","v2022-03-07","image/4.5.0","deb/4.5.0","chart/4.5.0","v2022-03-01","image/4.4.0","image/4.3.0","deb/4.4.0","deb/4.3.0","chart/4.4.0","chart/4.3.0","v2022-02-21","image/4.2.0","image/4.1.0","deb/4.2.0","deb/4.1.0","chart/4.2.0","chart/4.1.0","v2022-02-02","image/4.0.0","deb/4.0.0","chart/4.0.0","v2022-01-28","image/2.125.0","image/2.124.1","deb/3.66.0","deb/3.65.1","deb/3.65.0","chart=2.125.0,image=2.125.0","chart=2.124.1,image=2.124.1","v2022-01-27","image/2.124.0","image/2.122.13","deb/3.64.0","deb/3.63.13","chart=2.124.0,image=2.124.0","chart=2.122.13,image=2.122.13","v2022-01-18","image/2.122.0","deb/3.63.0","chart=2.122.0,image=2.122.0","v2021-12-10","image/2.121.0","image/2.120.0","image/2.119.21","deb/3.62.0","deb/3.61.0","deb/3.60.0","deb/3.59.21","chart=2.121.0,image=2.121.0","chart=2.120.0,image=2.120.0","chart=2.119.21,image=2.119.21","image/2.119.1","image/2.119.0","deb/3.59.1","deb/3.59.0","chart=2.119.1,image=2.119.1","chart=2.119.0,image=2.119.0","v2021-11-15","image/2.118.0","deb/3.58.0","chart=2.118.0,image=2.118.0","v2021-10-29","image/2.117.0","deb/3.57.0","chart=2.117.0,image=2.117.0","v2021-10-01","image/2.116.0","image/2.115.58","deb/3.56.0","deb/3.55.0","deb/3.54.60","chart=2.116.0,image=2.116.0","chart=2.115.58,image=2.115.58","v2021-09-14","image/2.115.0","image/2.114.18","deb/3.54.1","deb/3.54.0","chart=2.115.0,image=2.115.0","v2021-09-08","image/2.114.0","deb/3.53.0","chart=2.114.0,image=2.114.0","v2021-08-27","image/2.113.0","deb/3.52.0","chart=2.113.0,image=2.113.0","v2021-08-16","image/2.112.0","image/2.111.13","deb/3.51.0","deb/3.50.0","deb/3.49.13","chart=2.112.0,image=2.112.0","chart=2.111.13,image=2.111.13","v2021-08-02","image/2.111.0","image/2.110.32","deb/3.49.0","deb/3.48.31","chart=2.111.0,image=2.111.0","chart=2.110.32,image=2.110.32","v2021-07-09","image/2.110.0","image/2.109.29","deb/3.48.0","deb/3.47.28","chart=2.110.0,image=2.110.0","chart=2.109.29,image=2.109.29","v2021-06-23","image/2.109.0","deb/3.47.0","chart=2.109.0,image=2.109.0","v2021-06-08","image/2.108.0","deb/3.46.0","chart=2.108.0,image=2.108.0","v2021-05-26","image/2.107.0","deb/3.45.0","deb/3.44.39","chart=2.107.0,image=2.107.0","v2021-05-05","image/2.106.0","deb/3.44.0","deb/3.43.0","chart=2.106.0,image=2.106.0","v2021-05-04","image/2.105.0","chart=2.105.0,image=2.105.0","v2021-03-23","image/2.104.0","image/2.103.3","deb/3.38.1","deb/3.38.0","chart=2.104.0,image=2.104.0","v2021-03-22","v2021-03-21","image/2.103.0","deb/3.37.0","v2021-03-02","image/2.102.0","deb/3.36.0","chart=2.102.0,image=2.102.0","v2021-02-25","image/2.101.0","image/2.100.9","deb/3.35.0","chart=2.101.0,image=2.101.0","chart=2.100.9,image=2.100.9","v2021-02-16","image/2.99.12","image/2.100.0","deb/3.34.0","deb/3.33.0","deb/3.32.12","chart=2.99.12,image=2.99.12","chart=2.100.0,image=2.100.0","image/2.99.0","deb/3.32.0","image/2.98.0","image/2.97.7","deb/3.31.0","deb/3.30.7","chart=2.98.0,image=2.98.0","v2021-01-12","image/2.97.0","image/2.96.6","deb/3.30.0","deb/3.29.5","chart=2.97.0,image=2.97.0","chart=2.96.6,image=2.96.6","chart=2.96.5,image=2.96.5","image/2.96.0","deb/3.29.0","chart=2.96.0,image=2.96.0","v2020-12-21","image/2.95.0","deb/3.28.0","deb/3.27.12","v2020-12-15","image/2.94.0","deb/3.27.0","v2020-11-25","image/2.93.0","deb/3.25.0","deb/3.24.19","v2020-10-28","image/2.91.0","image/2.90.18","deb/3.24.0","deb/3.23.13","v2020-10-05","image/2.90.0","deb/3.23.0","deb/3.22.0","v2020-09-04","image/2.89.0","deb/3.21.0","deb/3.20.0","v2020-07-29","image/2.88.0","deb/3.19.0","v2020-07-13","image/2.87.0","deb/3.18.0","v2020-06-19","image/2.86.0","image/2.85.6","deb/3.17.0","deb/3.16.0","deb/3.15.0","deb/3.14.7","v2020-06-10","image/2.85.0","deb/3.14.0","v2020-06-03","image/2.84.0","deb/3.13.0","deb/3.12.0","deb/3.11.0","v2020-05-15","image/2.83.0","deb/3.10.0","v2020-05-07","image/2.82.0","image/2.81.19","deb/3.9.0","deb/3.8.0","deb/3.7.22","v2020-04-21","image/2.81.0","image/2.80.8","deb/3.7.0","deb/3.6.8","image/2.80.0","deb/3.6.0","image/2.79.0","deb/3.5.0","v2020-04-15","image/2.78.0","deb/3.4.0","v2020-03-10","image/2.77.0","deb/3.3.0","deb/3.2.0","v2020-02-27","image/2.76.0","v2020-02-18","image/2.75.0","image/2.74.0","image/2.73.14","image/2.73.12","image/2.73.13","image/2.73.11","image/2.73.10","image/2.73.9","image/2.73.8","image/2.73.7","image/2.73.6","image/2.73.5","image/2.73.4","image/2.73.3","image/2.73.2","image/2.72.3","image/2.72.2","image/2.70.21","v2020-01-09","image/2.70.0","image/2.70.13","image/2.70.20","image/2.70.19","image/2.70.18","image/2.70.16","image/2.70.17","image/2.70.14","image/2.70.12","image/2.70.11","image/2.70.10","image/2.70.9","image/2.70.8","image/2.70.7","image/2.70.6","image/2.70.5","image/2.70.4","image/2.70.3","image/2.69.0","v2019-12-20","image/2.68.0","image/2.67.1","image/2.67.0","v2019-11-28","image/2.66.0","v2019-11-06","image/2.65.0","image/2.64.0","v2019-09-30","image/2.63.1","image/2.63.0","v2019-09-16","image/2.62.0","v2019-09-03","image/2.61.0","image/2.60.1","image/2.60.0","v2019-08-08","image/2.59.0","v2019-07-08","image/2.58.0","image/2.57.1","image/2.57.0","image/2.56.0","image/2.55.0","image/2.54.0","v2019-05-02","image/2.53.0","v2019-04-09","image/2.52.0","v2019-03-25","image/2.51.0","image/2.50.341","v2019-02-28","image-2.50.315","v2019-02-22","v2019-02-18","v2019-01-24","v2019-01-10","v2018-12-06","v2018-11-28","v2018-10-04"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-22737.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}