CVE-2021-21301

Wire is an open-source collaboration platform. In Wire for iOS (iPhone and iPad) before version 3.75 there is a vulnerability where the video capture isn't stopped in a scenario where a user first has their camera enabled and then disables it. It's a privacy issue because video is streamed to the call when the user believes it is disabled. It impacts all users in video calls. This is fixed in version 3.75.

CVSS v3 2.6 LOW
CVSS v2.0 4.3 MEDIUM

2.6^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/wireapp/wire-ios/commit/7e3c30120066c9b10e50cc0d20012d0849c33a40	Patch Third Party Advisory
https://github.com/wireapp/wire-ios/pull/4879	Patch Third Party Advisory
https://github.com/wireapp/wire-ios/security/advisories/GHSA-7fg4-x8vj-qvxf	Patch Third Party Advisory
https://github.com/wireapp/wire-ios/commit/7e3c30120066c9b10e50cc0d20012d0849c33a40	Patch Third Party Advisory
https://github.com/wireapp/wire-ios/pull/4879	Patch Third Party Advisory
https://github.com/wireapp/wire-ios/security/advisories/GHSA-7fg4-x8vj-qvxf	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wire:wire:*:*:*:*:*:iphone_os:*:*

History

No history.

Information

Published : 2021-02-11 18:15

Updated : 2024-11-21 05:47

NVD link : CVE-2021-21301

Mitre link : CVE-2021-21301

CVE.ORG link : CVE-2021-21301

JSON object : View

Products Affected

wire

wire

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2021-21301", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.6, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2021-02-11T18:15:16.910", "references": [{"url": "https://github.com/wireapp/wire-ios/commit/7e3c30120066c9b10e50cc0d20012d0849c33a40", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/wireapp/wire-ios/pull/4879", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/wireapp/wire-ios/security/advisories/GHSA-7fg4-x8vj-qvxf", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/wireapp/wire-ios/commit/7e3c30120066c9b10e50cc0d20012d0849c33a40", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/wireapp/wire-ios/pull/4879", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/wireapp/wire-ios/security/advisories/GHSA-7fg4-x8vj-qvxf", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Wire is an open-source collaboration platform. In Wire for iOS (iPhone and iPad) before version 3.75 there is a vulnerability where the video capture isn't stopped in a scenario where a user first has their camera enabled and then disables it. It's a privacy issue because video is streamed to the call when the user believes it is disabled. It impacts all users in video calls. This is fixed in version 3.75."}, {"lang": "es", "value": "Wire es una plataforma de colaboraci\u00f3n de c\u00f3digo abierto. En Wire para iOS (iPhone y iPad) anterior a versi\u00f3n 3.75, se presenta una vulnerabilidad en la que la captura de video no se detiene en un escenario en el que un usuario primero tiene su c\u00e1mara habilitada y luego la deshabilita. Es un problema de privacidad porque el video se transmite a la llamada cuando el usuario cree que est\u00e1 deshabilitado. Afecta a todos los usuarios en las videollamadas. Esto se corrige en la versi\u00f3n 3.75"}], "lastModified": "2024-11-21T05:47:58.573", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wire:wire:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "9D324BAB-15A4-4787-8EC0-8AE5F18C84A8", "versionEndExcluding": "3.75"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}