Medium severity · published Apr 2, 2021
CVE-2021-21400
wire-webapp is an open-source front end for Wire, a secure collaboration platform
6.5
CVSS
1.2%
EPSS
No
On KEV
Description
wire-webapp is an open-source front end for Wire, a secure collaboration platform. In wire-webapp before version 2021-03-15-production.0, when being prompted to enter the app-lock passphrase, the typed passphrase will be sent into the most recently used chat when the user does not actively give focus to the input field. Input element focus is enforced programatically in version 2021-03-15-production.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
Wire-webapp · Wire
through 2019-07-11-13-18; 2019-02-11; 2019-02-11; 2019-02-11; 2019-02-13; 2019-02-18; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21400
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-21400
Patch
https://github.com/wireapp/wire-webapp/commit/281f2a9d795f68abe423c116d5da4e1e73a60062
Patch
https://github.com/wireapp/wire-webapp/pull/10704
Release Notes
https://github.com/wireapp/wire-webapp/releases/tag/2021-03-15-production.0
Third Party Advisory
https://github.com/wireapp/wire-webapp/security/advisories/GHSA-cxwr-f2j3-q8hp
More from Wire-webapp
6.1
CVE-2022-29168
Wire is a secure messaging application
6.1
CVE-2022-24799
wire-webapp is the web application interface for the wire messaging service
6.1
CVE-2021-32683
wire-webapp is the web version of Wire, an open-source messenger
5.5
CVE-2025-48066
wire-webapp has no database deletion on client logout
5.3
CVE-2022-39380
Wire web-app is part of Wire communications