Security Advisories

Stay informed about security vulnerabilities and updates for ClientComm products.

Our Security Principles

At ClientComm, security is our top priority. We follow these core principles to keep your data safe.

End-to-End Encryption

All messages and data are encrypted in transit and at rest.

Regular Security Audits

We conduct regular security audits and penetration testing.

Responsible Disclosure

We promptly disclose and address security vulnerabilities.

CVE-2023-001•November 15, 2023

Authentication Token Validation Issue

High

Affected Versions

Web App v2.1.0-2.1.5, iOS v2.0.3, Android v2.0.2

Fixed Versions

Web App v2.1.6, iOS v2.0.4, Android v2.0.3

Description

A vulnerability was discovered in the authentication token validation process that could potentially allow an attacker to bypass authentication under specific circumstances.

Impact

An attacker with knowledge of the vulnerability could potentially access user accounts without proper authentication.

Mitigation

All users should update to the latest version of the application. The issue has been fixed in Web App v2.1.6, iOS v2.0.4, and Android v2.0.3.

Technical Details

The vulnerability was caused by improper validation of JWT tokens in certain edge cases. The fix implements additional validation checks and improves the token verification process.

CVE-2023-002•September 28, 2023

Cross-Site Scripting (XSS) in Message Display

Medium

Affected Versions

Web App v2.0.0-2.0.8

Fixed Versions

Web App v2.0.9

Description

A cross-site scripting vulnerability was discovered in the message display component of the web application.

Impact

An attacker could potentially inject malicious scripts into messages, which would be executed when viewed by other users.

Mitigation

Update to Web App v2.0.9 or later. The issue has been fixed by implementing proper input sanitization and output encoding.

Technical Details

The vulnerability was present in the message rendering component where user input was not properly sanitized before being displayed in the DOM. The fix implements proper HTML sanitization and ensures all user-generated content is safely rendered.

CVE-2023-003•July 12, 2023

Information Disclosure in API Responses

Low

Affected Versions

Web App v1.9.5-2.0.2, iOS v1.9.0-1.9.5, Android v1.9.0-1.9.5

Fixed Versions

Web App v2.0.3, iOS v1.9.6, Android v1.9.6

Description

An information disclosure vulnerability was discovered in certain API responses that could potentially expose sensitive metadata.

Impact

The vulnerability could potentially expose internal system information that might aid attackers in fingerprinting the system.

Mitigation

Update to the latest version of the application. The issue has been fixed in Web App v2.0.3, iOS v1.9.6, and Android v1.9.6.

Technical Details

The vulnerability was caused by including unnecessary debug information in API responses. The fix removes this information from production environments and implements proper filtering of response data.

CVE-2022-001•December 5, 2022

Insecure Direct Object Reference in File Access

Critical

Affected Versions

Web App v1.8.0-1.9.0

Fixed Versions

Web App v1.9.1

Description

A critical vulnerability was discovered in the file access mechanism that could allow unauthorized access to files.

Impact

An attacker could potentially access files belonging to other users by manipulating file identifiers in requests.

Mitigation

Update to Web App v1.9.1 or later immediately. The issue has been fixed by implementing proper authorization checks for all file access requests.

Technical Details

The vulnerability was caused by insufficient authorization checks when accessing files through the API. The fix implements proper access control checks and validates user permissions before allowing access to files.

Report a Vulnerability

We take security seriously and appreciate the security community's efforts in helping us maintain a secure platform.

Responsible Disclosure Policy

If you believe you've found a security vulnerability in any ClientComm-owned repository, service, or product, please report it to us through our coordinated disclosure process.

Email your findings to security@clientcomm.ai

Include detailed information about the vulnerability and steps to reproduce it

Allow us reasonable time to address the issue before public disclosure

Report a Vulnerability