PT-2021-19854 · Wire Swiss Gmbh · Wire

Kane Gamble · Published 2021-06-15 · Updated 2021-06-23 · CVE-2021-32683

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wire-webapp versions prior to 2021-06-01-production.0

Description A cross-site scripting issue exists in the web version of Wire, an open-source messenger. If a user opens an image in a new tab, the image payload is executed on the domain hosting the app. This allows malicious code within the image to be executed, potentially giving an attacker full control over the user account.

Recommendations For versions prior to 2021-06-01-production.0, update to version 2021-06-01-production.0 to resolve the issue. As a temporary workaround, users should not try to open image URLs.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-32683

GHSA-382J-MMC8-M5RW

Affected Products

Wire

References · 5

• 🔥 https://github.com/wireapp/wire-webapp/commit/056e39d327bb10c1b0958dfbea0c39752692a1b0 · Exploit
• https://github.com/wireapp/wire-webapp/security/advisories/GHSA-382j-mmc8-m5rw · Patch
• https://osv.dev/vulnerability/CVE-2021-32683 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32683 · Security Note
• https://t.me/cvenotify/16377 · Telegram Post