CVE-2021-41101 Information

Description

wire-server is an open-source back end for Wire a secure collaboration platform. Before version 2.106.0 the CORS Access-Control-Allow-Origin header set by nginz is set for all subdomains of .wire.com (including wire.com). This means that if somebody were to find an XSS vector in any of the subdomains they could use it to talk to the Wire API using the user’s Cookie. A patch does not exist but a workaround does. To make sure that a compromise of one subdomain does not yield access to the cookie of another one may limit the Access-Control-Allow-Origin header to apps that actually require the cookie (account-pages team-settings and the webapp).

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Reference

https://github.com/wireapp/wire-server/security/advisories/GHSA-v7xx-cx8m-g66p

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

NONE

Base Severity

5.7