Lucene search

K
cvelistGitHub_MCVELIST:CVE-2021-32755
HistoryJul 13, 2021 - 8:55 p.m.

CVE-2021-32755 Certificate pinning is not enforced on the web socket connection

2021-07-1320:55:09
CWE-295
GitHub_M
www.cve.org
3
cve-2021-32755
certificate pinning
web socket
wire ios
authentication
network failures
retries
version 3.82
version 3.84

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

22.7%

Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retries for the iOS implementation of Wire. In the 3.82 version of the iOS application, a new web socket implementation was introduced for users running iOS 13 or higher. This new websocket implementation is not configured to enforce certificate pinning when available. Certificate pinning for the new websocket is enforced in version 3.84 or above.

CNA Affected

[
  {
    "product": "wire-ios-transport",
    "vendor": "wireapp",
    "versions": [
      {
        "status": "affected",
        "version": "= 3.8.2"
      }
    ]
  }
]

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

22.7%

Related for CVELIST:CVE-2021-32755