Description: wire-server is an open-source back end for Wire, a secure collaboration platform. In wire-server from version 2021-02-16 and before version 2021-03-02, the client metadata of all users was exposed in the `GET /users/list-clients` endpoint. The endpoint could be used by any logged in user who could request client details of any other user (no connection required) as far as they can find their User ID. The exposed metadata included id, class, type, location, time, and cookie. A user on a Wire backend could use this endpoint to find registration time and location for each device for a given list of users. As a workaround, remove `/list-clients` from nginx config. This has been fixed in version 2021-03-02.
CVE-2021-21396
Published Date: 2021-03-26T22:15Z
Last Modified: 2021-08-27T15:05Z
CVSS Score: 6.5 (MEDIUM)
EPSS Score: 0.10%
Risk Score: 4.55 (MEDIUM)
Risk Score based on CVSS score and EPSS. This score is for reference purposes and is not internationally recognized.
CVSS:
6.5 |
EPSS:
0.1%
Mitre ATT&CK Technical v15.1
T1153 – Source
T1583.004 – Server
T1584.004 – Server
T1053.002 – At
Technical Analysis & Mitigation Measures
Reference Links
Vendor - Produce - Version
wire_server - wire
Disclaimer
The content on this website is automatically sourced from external websites such as the National Vulnerability Database (NVD), GitHub, and other security-related sources. This content is for reference purposes only, and we are not responsible for the accuracy or integrity of the information linked or displayed from these sources.