// For flags

CVE-2021-32755

Certificate pinning is not enforced on the web socket connection

Severity Score

4.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retries for the iOS implementation of Wire. In the 3.82 version of the iOS application, a new web socket implementation was introduced for users running iOS 13 or higher. This new websocket implementation is not configured to enforce certificate pinning when available. Certificate pinning for the new websocket is enforced in version 3.84 or above.

Wire es una plataforma de colaboración. wire-ios-transport maneja la autenticación de peticiones, los fallos de red y los reintentos para la implementación de Wire en iOS. En la versión 3.82 de la aplicación iOS, se introdujo una nueva implementación de websocket para los usuarios que ejecutan iOS versión 13 o superior. Esta nueva implementación de websocket no está configurada para aplicar la fijación de certificados cuando está disponible. La fijación de certificados para el nuevo websocket se aplica en la versión 3.84 o superior

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-05-12 CVE Reserved
  • 2021-07-13 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-295: Improper Certificate Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Wire
Search vendor "Wire"
 Wire
Search vendor "Wire" for product "Wire"
 < 3.84
Search vendor "Wire" for product "Wire" and version " < 3.84"
-
Affected
in Apple
Search vendor "Apple"
 Iphone Os
Search vendor "Apple" for product "Iphone Os"
 >= 13.0
Search vendor "Apple" for product "Iphone Os" and version " >= 13.0"
-
Safe