CVE-2021-21396

🗓️ 26 Mar 2021 21:40:15Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 236 Views🌐 WEB

wire-server exposed client metadata in `GET /users/list-clients` endpoint, allowing any user to access details of other users without connection

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2021-21396	26 Mar 202122:15	–	attackerkb
CNNVD	Invigo Automatic Device Management 路径遍历漏洞	26 Mar 202100:00	–	cnnvd
CNNVD	wire-server 信息泄露漏洞	26 Mar 202100:00	–	cnnvd
Cvelist	CVE-2021-21396 Bulk list client endpoint exposes too much metadata about a client	26 Mar 202121:40	–	cvelist
EUVD	EUVD-2021-8693	3 Oct 202520:07	–	euvd
NVD	CVE-2021-21396	26 Mar 202122:15	–	nvd
Prion	Design/Logic Flaw	26 Mar 202122:15	–	prion
RedhatCVE	CVE-2021-21396	22 May 202521:30	–	redhatcve

NVD

Vulners

Node

wire wire_serverRange2021-02-16–2021-03-02

[
  {
    "product": "wire-server",
    "vendor": "wireapp",
    "versions": [
      {
        "status": "affected",
        "version": ">= 2021-02-16, < 2021-03-02"
      }
    ]
  }
]

Source	Link
github	www.github.com/wireapp/wire-server/security/advisories/GHSA-qx8q-rhq2-rg4j
github	www.github.com/wireapp/wire-server/commit/7ba2bf4140282557cf215e0b2c354d4d08cd3421
github	www.github.com/wireapp/wire-server/releases/tag/v2021-03-02

Parameter	Position	Path	Description	CWE
user_id	query param	users/list-clients	GET /users/list-clients endpoint exposes sensitive client metadata (id, class, type, location, time, cookie) for other users; can be accessed by any logged-in user who can determine a target user's ID, indicating improper access control.	CWE-200

17 Jun 2026 03:35Current

6.4Medium risk

Vulners AI Score6.4

CVSS 24

CVSS 3.16.5

EPSS0.01093

CWE-200