CVE - CVE-2021-41093

CVE-ID
CVE-2021-41093	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing the email. This issue has been resolved in version 3.86 which uses a new endpoint which additionally requires an authentication cookie. See wire-ios-sync-engine and wire-ios-transport references. This is the root advisory that pulls the changes together.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://github.com/wireapp/wire-ios/security/advisories/GHSA-6f4c-phfj-m255 URL:https://github.com/wireapp/wire-ios/security/advisories/GHSA-6f4c-phfj-m255 MISC:https://github.com/wireapp/wire-ios-sync-engine/security/advisories/GHSA-w727-5f74-49xj URL:https://github.com/wireapp/wire-ios-sync-engine/security/advisories/GHSA-w727-5f74-49xj MISC:https://github.com/wireapp/wire-ios-transport/security/advisories/GHSA-p354-6r3m-g4xr URL:https://github.com/wireapp/wire-ios-transport/security/advisories/GHSA-p354-6r3m-g4xr MISC:https://github.com/wireapp/wire-ios/commit/b0e7bb3b13dd8212032cb46e32edf701694687c7 URL:https://github.com/wireapp/wire-ios/commit/b0e7bb3b13dd8212032cb46e32edf701694687c7 MISC:https://github.com/wireapp/wire-server/security/advisories/GHSA-9rm2-w6pq-333m URL:https://github.com/wireapp/wire-server/security/advisories/GHSA-9rm2-w6pq-333m
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20210915	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20210915)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)