Medium severity · published Feb 11, 2021
CVE-2021-21301
Wire is an open-source collaboration platform
4.3
CVSS
1%
EPSS
No
On KEV
Description
Wire is an open-source collaboration platform. In Wire for iOS (iPhone and iPad) before version 3.75 there is a vulnerability where the video capture isn't stopped in a scenario where a user first has their camera enabled and then disables it. It's a privacy issue because video is streamed to the call when the user believes it is disabled. It impacts all users in video calls. This is fixed in version 3.75.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
Wire · Wire
before 3.75 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21301
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-21301
Patch
https://github.com/wireapp/wire-ios/commit/7e3c30120066c9b10e50cc0d20012d0849c33a40
Patch
https://github.com/wireapp/wire-ios/pull/4879
Patch
https://github.com/wireapp/wire-ios/security/advisories/GHSA-7fg4-x8vj-qvxf
More from Wire
9.8
CVE-2021-41093
Wire is an open source secure messenger
9.8
CVE-2020-27853
Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a format string
8.0
CVE-2020-15258
In Wire before 3.20.x, `shell.openExternal` was used without checking the URL
7.5
CVE-2018-8909
The Wire application before 2018-03-07 for Android allows attackers to write to pathnames outside of the downloads directory via a ../ in a filename of a received file, related to…
6.5
CVE-2023-22737
wire-server provides back end services for Wire, a team communication and collaboration platform