CVE-2021-41094

Katalog CVE

CVSS 4.6 · Medium EPSS 0,18%

Kerentanan Exposure of Resource to Wrong Sphere pada wire. Skor CVSS 3.1 4.6 (Medium) menurut NVD.

Deskripsi (NVD)

Wire is an open source secure messenger. Users of Wire by Bund may bypass the mandatory encryption at rest feature by simply disabling their device passcode. Upon launching, the app will attempt to enable encryption at rest by generating encryption keys via the Secure Enclave, however it will fail silently if no device passcode is set. The user has no indication that encryption at rest is not active since the feature is hidden to them. This issue has been resolved in version 3.70

Rincian

Terbit di NVD

4 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.6 (Medium), sumber NVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wireapp/wire-ios/commit/5ba3eb180efc3fc795d095f9c84ae7f109b84746 patch · advisory pihak ketiga
• https://github.com/wireapp/wire-ios/security/advisories/GHSA-h4m7-pr8h-j7rf advisory pihak ketiga