Vulnerability · Published Jun 3, 2021 · Assigned by GitHub_M

CVE-2021-32665Verified groups not reliable

High 8.8

In plain English

A high-severity insufficient verification of data authenticity in wire-ios from wireapp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 58.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

wire-ios is the iOS version of Wire, an open-source secure messaging app. wire-ios versions 3.8.0 and earlier have a bug in which a conversation could be incorrectly set to "unverified. This occurs when: - Self user is added to a new conversation - Self user is added to an existing conversation - All the participants in the conversation were previously marked as verified. The vulnerability is patched in wire-ios version 3.8.1. As a workaround, one can unverify & verify a device in the conversation.

Affected products (as reported)

Vendor	Product	Versions
wireapp	wire-ios	<= 3.8.0

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/wireapp/wire-ios/security/advisories/GHSA-mc65-7w99-c6qv x_refsource_CONFIRM
https://github.com/wireapp/wire-ios-data-model/commit/bf9db85886b12a20c8374f55b7c4a610e8ae9220 x_refsource_MISC