CVE-2021-41101: medium-severity vulnerability in wireapp wire-server
CORS `Access-Control-Allow-Origin` settings are too lenient
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.7epss 0.7%
wire-server is an open-source back end for Wire, a secure collaboration platform. Before version 2.106.0, the CORS ` Access-Control-Allow-Origin ` header set by `nginz` is set for all subdomains of `.wire.com` (including `wire.com`). This means that if somebody were to find an XSS vector in any of the subdomains, they could use it to talk to the Wire API using the user's Cookie. A patch does not exist, but a workaround does. To make sure that a compromise of one subdomain does not yield access to the cookie of another, one may limit the `Access-Control-Allow-Origin` header to apps that actually require the cookie (account-pages, team-settings and the webapp).
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected products
wireapp · wire-serverRelated CVEs — wireapp wire-server
In the same product, most dangerous first.
CVE-2021-41119MEDIUMDoS vulnerabiliity in wire-server json parserEPSS 1.4%CVE-2021-21396MEDIUMBulk list client endpoint exposes too much metadata about a clientEPSS 1.2%CVE-2021-41100HIGHAccount takeover when having only access to a user's short lived token in wire-serverEPSS 0.9%CVE-2023-22737MEDIUMwire-server vulnerable to unauthorized removal of Bots from ConversationsEPSS 0.8%CVE-2022-31122CRITICALWire-server vulnerable to Token Recipient Confusion resulting in account impersonation, deletion or malicious account creationEPSS 0.7%CVE-2022-23610CRITICALImproper Verification of Cryptographic Signature in wire-serverEPSS 0.7%