PT-2021-14477 · Unknown · Wire-Webapp

Franziskuskiefer · Published 2021-04-02 · Updated 2021-04-07 · CVE-2021-21400

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions wire-webapp versions prior to 2021-03-15-production.0

Description The issue occurs when a user is prompted to enter the app-lock passphrase in wire-webapp. If the user does not actively give focus to the input field, the typed passphrase will be sent into the most recently used chat. This is resolved in version 2021-03-15-production.0, where input element focus is enforced programmatically.

Recommendations For versions prior to 2021-03-15-production.0, update to version 2021-03-15-production.0 or later to resolve the issue. As a temporary workaround, consider ensuring that the input field for the app-lock passphrase is actively focused before entering the passphrase to prevent it from being sent into the most recently used chat.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-21400

GHSA-CXWR-F2J3-Q8HP

Affected Products

Wire-Webapp

References · 9

• https://github.com/wireapp/wire-webapp/pull/10704 · Patch
• https://github.com/wireapp/wire-webapp/commit/281f2a9d795f68abe423c116d5da4e1e73a60062 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21400 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21400 · Vendor Advisory
• https://github.com/wireapp/wire-webapp/releases/tag/2021-03-15-production.0 · Note
• https://github.com/wireapp/wire-webapp/security/advisories/GHSA-cxwr-f2j3-q8hp · Note
• https://t.me/cvenotify/12532 · Telegram Post
• https://t.me/cvenotify/12821 · Telegram Post
• https://t.me/cvenotify/12524 · Telegram Post