CVE-2021-41093
High
Description
Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing the email. This issue has been resolved in version 3.86 which uses a new endpoint which additionally requires an authentication cookie. See wire-ios-sync-engine and wire-ios-transport references. This is the root advisory that pulls the changes together.
SeverityHigh
CVSS7.4
Exploit probability—
ProductWire
PublishedOct 4, 2021
First seenOct 4, 2021
Weakness typeCWE-285CWE-285
How to fix
Update
- wire wire3.86 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wire wire | v < 3.86 | 3.86 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.