CVE-2021-21301 - OpenCVE

Wire is an open-source collaboration platform. In Wire for iOS (iPhone and iPad) before version 3.75 there is a vulnerability where the video capture isn't stopped in a scenario where a user first has their camera enabled and then disables it. It's a privacy issue because video is streamed to the call when the user believes it is disabled. It impacts all users in video calls. This is fixed in version 3.75.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:M/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Wire	Wire

Configuration 1 [-]

cpe:2.3:a:wire:wire:*:*:*:*:*:iphone_os:*:*

No data.

References

Link	Providers
https://github.com/wireapp/wire-ios/commit/7e3c30120066c9b10e50cc0d20012d0849c33a40
https://github.com/wireapp/wire-ios/pull/4879
https://github.com/wireapp/wire-ios/security/advisories/GHSA-7fg4-x8vj-qvxf

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2021-02-11T18:05:19

Updated: 2024-08-03T18:09:15.618Z

Reserved: 2020-12-22T00:00:00

Link: CVE-2021-21301

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-02-11T18:15:16.910

Modified: 2021-04-20T20:51:08.650

Link: CVE-2021-21301

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "wire-ios", "vendor": "wireapp", "versions": [{"status": "affected", "version": "< 3.75"}]}], "descriptions": [{"lang": "en", "value": "Wire is an open-source collaboration platform. In Wire for iOS (iPhone and iPad) before version 3.75 there is a vulnerability where the video capture isn't stopped in a scenario where a user first has their camera enabled and then disables it. It's a privacy issue because video is streamed to the call when the user believes it is disabled. It impacts all users in video calls. This is fixed in version 3.75."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.6, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Information Exposure", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-02-11T18:05:19", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wireapp/wire-ios/security/advisories/GHSA-7fg4-x8vj-qvxf"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/wireapp/wire-ios/pull/4879"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/wireapp/wire-ios/commit/7e3c30120066c9b10e50cc0d20012d0849c33a40"}], "source": {"advisory": "GHSA-7fg4-x8vj-qvxf", "discovery": "UNKNOWN"}, "title": "Video feed was captured while user has disabled video", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-21301", "STATE": "PUBLIC", "TITLE": "Video feed was captured while user has disabled video"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "wire-ios", "version": {"version_data": [{"version_value": "< 3.75"}]}}]}, "vendor_name": "wireapp"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Wire is an open-source collaboration platform. In Wire for iOS (iPhone and iPad) before version 3.75 there is a vulnerability where the video capture isn't stopped in a scenario where a user first has their camera enabled and then disables it. It's a privacy issue because video is streamed to the call when the user believes it is disabled. It impacts all users in video calls. This is fixed in version 3.75."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.6, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-200 Information Exposure"}]}]}, "references": {"reference_data": [{"name": "https://github.com/wireapp/wire-ios/security/advisories/GHSA-7fg4-x8vj-qvxf", "refsource": "CONFIRM", "url": "https://github.com/wireapp/wire-ios/security/advisories/GHSA-7fg4-x8vj-qvxf"}, {"name": "https://github.com/wireapp/wire-ios/pull/4879", "refsource": "MISC", "url": "https://github.com/wireapp/wire-ios/pull/4879"}, {"name": "https://github.com/wireapp/wire-ios/commit/7e3c30120066c9b10e50cc0d20012d0849c33a40", "refsource": "MISC", "url": "https://github.com/wireapp/wire-ios/commit/7e3c30120066c9b10e50cc0d20012d0849c33a40"}]}, "source": {"advisory": "GHSA-7fg4-x8vj-qvxf", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T18:09:15.618Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/wireapp/wire-ios/security/advisories/GHSA-7fg4-x8vj-qvxf"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/wireapp/wire-ios/pull/4879"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/wireapp/wire-ios/commit/7e3c30120066c9b10e50cc0d20012d0849c33a40"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-21301", "datePublished": "2021-02-11T18:05:19", "dateReserved": "2020-12-22T00:00:00", "dateUpdated": "2024-08-03T18:09:15.618Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wire:wire:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "9D324BAB-15A4-4787-8EC0-8AE5F18C84A8", "versionEndExcluding": "3.75", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wire is an open-source collaboration platform. In Wire for iOS (iPhone and iPad) before version 3.75 there is a vulnerability where the video capture isn't stopped in a scenario where a user first has their camera enabled and then disables it. It's a privacy issue because video is streamed to the call when the user believes it is disabled. It impacts all users in video calls. This is fixed in version 3.75."}, {"lang": "es", "value": "Wire es una plataforma de colaboraci\u00f3n de c\u00f3digo abierto. En Wire para iOS (iPhone y iPad) anterior a versi\u00f3n 3.75, se presenta una vulnerabilidad en la que la captura de video no se detiene en un escenario en el que un usuario primero tiene su c\u00e1mara habilitada y luego la deshabilita. Es un problema de privacidad porque el video se transmite a la llamada cuando el usuario cree que est\u00e1 deshabilitado. Afecta a todos los usuarios en las videollamadas. Esto se corrige en la versi\u00f3n 3.75"}], "id": "CVE-2021-21301", "lastModified": "2021-04-20T20:51:08.650", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.6, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2021-02-11T18:15:16.910", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/wireapp/wire-ios/commit/7e3c30120066c9b10e50cc0d20012d0849c33a40"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/wireapp/wire-ios/pull/4879"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/wireapp/wire-ios/security/advisories/GHSA-7fg4-x8vj-qvxf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Primary"}]}