wire server vulnerabilities

Latest wire server CVEs

Newest publication first

1. CVE-2022-31122 Wire-server vulnerable to Token Recipient Confusion resulting in account impersonation, deletion or malicious account creation

   Published 2022-10-18

   High·CVSS 8.1 EPSS 0.74%

   Wire is an encrypted communication and collaboration platform. Versions prior to 2022-07-12/Chart 4.19.0 are subject to Token Recipient Confusion. If an attacker has certain details of SAML IdP metadata, and configures their own SAML on the same backend, the attacker can delete a...

2. CVE-2021-41101 CORS `Access-Control-Allow-Origin` settings are too lenient

   Published 2021-09-30

   Medium·CVSS 5.7 EPSS 0.71%

   wire-server is an open-source back end for Wire, a secure collaboration platform. Before version 2.106.0, the CORS Access-Control-Allow-Origin header set by nginz is set for all subdomains of .wire.com (including wire.com). This means that if somebody were to find an XSS vector i...

3. CVE-2021-21396 Bulk list client endpoint exposes too much metadata about a client

   Published 2021-03-26

   Medium·CVSS 6.5 EPSS 1.2%

   wire-server is an open-source back end for Wire, a secure collaboration platform. In wire-server from version 2021-02-16 and before version 2021-03-02, the client metadata of all users was exposed in the GET /users/list-clients endpoint. The endpoint could be used by any logged i...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.