Vulnerability Details CVE-2021-21400
wire-webapp is an open-source front end for Wire, a secure collaboration platform. In wire-webapp before version 2021-03-15-production.0, when being prompted to enter the app-lock passphrase, the typed passphrase will be sent into the most recently used chat when the user does not actively give focus to the input field. Input element focus is enforced programatically in version 2021-03-15-production.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 60.9%
CVSS Severity
CVSS v3 Score 7.1
CVSS v2 Score 4.3
References
- https://github.com/wireapp/wire-webapp/commit/281f2a9d795f68abe423c116d5da4e1e73a60062
- https://github.com/wireapp/wire-webapp/pull/10704
- https://github.com/wireapp/wire-webapp/releases/tag/2021-03-15-production.0
- https://github.com/wireapp/wire-webapp/security/advisories/GHSA-cxwr-f2j3-q8hp
- https://github.com/wireapp/wire-webapp/commit/281f2a9d795f68abe423c116d5da4e1e73a60062
- https://github.com/wireapp/wire-webapp/pull/10704
- https://github.com/wireapp/wire-webapp/releases/tag/2021-03-15-production.0
- https://github.com/wireapp/wire-webapp/security/advisories/GHSA-cxwr-f2j3-q8hp
Products affected by CVE-2021-21400
-
cpe:2.3:a:wire:wire-webapp:2016-07-29-17-00
-
cpe:2.3:a:wire:wire-webapp:2016-08-04-15-44
-
cpe:2.3:a:wire:wire-webapp:2016-08-23-09-31
-
cpe:2.3:a:wire:wire-webapp:2016-08-24-10-10
-
cpe:2.3:a:wire:wire-webapp:2016-08-29-14-54
-
cpe:2.3:a:wire:wire-webapp:2016-09-08-15-38
-
cpe:2.3:a:wire:wire-webapp:2016-09-19-14-01
-
cpe:2.3:a:wire:wire-webapp:2016-09-28-14-58
-
cpe:2.3:a:wire:wire-webapp:2016-10-11-15-34
-
cpe:2.3:a:wire:wire-webapp:2016-10-18-08-10
-
cpe:2.3:a:wire:wire-webapp:2016-10-25-08-17
-
cpe:2.3:a:wire:wire-webapp:2016-10-26-18-58
-
cpe:2.3:a:wire:wire-webapp:2016-11-03-16-09
-
cpe:2.3:a:wire:wire-webapp:2016-11-08-15-06
-
cpe:2.3:a:wire:wire-webapp:2016-12-01-12-57
-
cpe:2.3:a:wire:wire-webapp:2016-12-13-15-12
-
cpe:2.3:a:wire:wire-webapp:2017-01-23-12-12
-
cpe:2.3:a:wire:wire-webapp:2017-02-01-14-49
-
cpe:2.3:a:wire:wire-webapp:2017-02-17-10-10
-
cpe:2.3:a:wire:wire-webapp:2017-02-24-13-06
-
cpe:2.3:a:wire:wire-webapp:2017-03-08-17-32
-
cpe:2.3:a:wire:wire-webapp:2017-03-14-15-05
-
cpe:2.3:a:wire:wire-webapp:2017-03-21-11-00
-
cpe:2.3:a:wire:wire-webapp:2017-03-27-17-10
-
cpe:2.3:a:wire:wire-webapp:2017-03-28-14-23
-
cpe:2.3:a:wire:wire-webapp:2017-04-05-16-58
-
cpe:2.3:a:wire:wire-webapp:2017-04-07-09-42
-
cpe:2.3:a:wire:wire-webapp:2017-04-19-12-31
-
cpe:2.3:a:wire:wire-webapp:2017-04-20-15-54
-
cpe:2.3:a:wire:wire-webapp:2017-05-03-10-29
-
cpe:2.3:a:wire:wire-webapp:2017-05-19-16-10
-
cpe:2.3:a:wire:wire-webapp:2017-05-26-08-16
-
cpe:2.3:a:wire:wire-webapp:2017-05-26-12-03
-
cpe:2.3:a:wire:wire-webapp:2017-06-01-10-02
-
cpe:2.3:a:wire:wire-webapp:2017-06-07-15-03
-
cpe:2.3:a:wire:wire-webapp:2017-06-07-18-05
-
cpe:2.3:a:wire:wire-webapp:2017-06-22-12-18
-
cpe:2.3:a:wire:wire-webapp:2017-06-28-15-13
-
cpe:2.3:a:wire:wire-webapp:2017-07-06-12-44
-
cpe:2.3:a:wire:wire-webapp:2017-07-06-15-48
-
cpe:2.3:a:wire:wire-webapp:2017-07-18-12-50
-
cpe:2.3:a:wire:wire-webapp:2017-08-03-15-19
-
cpe:2.3:a:wire:wire-webapp:2017-08-04-09-04
-
cpe:2.3:a:wire:wire-webapp:2017-08-04-15-01
-
cpe:2.3:a:wire:wire-webapp:2017-08-08-15-09
-
cpe:2.3:a:wire:wire-webapp:2017-08-24-10-57
-
cpe:2.3:a:wire:wire-webapp:2017-08-31-14-21
-
cpe:2.3:a:wire:wire-webapp:2017-09-26-07-18
-
cpe:2.3:a:wire:wire-webapp:2017-09-26-13-00
-
cpe:2.3:a:wire:wire-webapp:2017-10-09-08-42
-
cpe:2.3:a:wire:wire-webapp:2017-10-19-10-45
-
cpe:2.3:a:wire:wire-webapp:2017-10-25-07-08
-
cpe:2.3:a:wire:wire-webapp:2017-11-07-08-50
-
cpe:2.3:a:wire:wire-webapp:2017-11-10-10-41
-
cpe:2.3:a:wire:wire-webapp:2017-12-04-10-23
-
cpe:2.3:a:wire:wire-webapp:2017-12-04-13-34
-
cpe:2.3:a:wire:wire-webapp:2017-12-07-11-13
-
cpe:2.3:a:wire:wire-webapp:2017-12-20-12-48
-
cpe:2.3:a:wire:wire-webapp:2018-01-24-18-11
-
cpe:2.3:a:wire:wire-webapp:2018-02-01-10-26
-
cpe:2.3:a:wire:wire-webapp:2018-02-16-07-54
-
cpe:2.3:a:wire:wire-webapp:2018-03-12-11-41
-
cpe:2.3:a:wire:wire-webapp:2018-04-06-07-28
-
cpe:2.3:a:wire:wire-webapp:2018-04-06-09-44
-
cpe:2.3:a:wire:wire-webapp:2018-04-09-10-16
-
cpe:2.3:a:wire:wire-webapp:2018-04-12-06-45
-
cpe:2.3:a:wire:wire-webapp:2018-04-12-11-12
-
cpe:2.3:a:wire:wire-webapp:2018-04-12-13-37
-
cpe:2.3:a:wire:wire-webapp:2018-04-24-14-58
-
cpe:2.3:a:wire:wire-webapp:2018-05-04-07-18
-
cpe:2.3:a:wire:wire-webapp:2018-05-24-15-49
-
cpe:2.3:a:wire:wire-webapp:2018-06-19-08-04
-
cpe:2.3:a:wire:wire-webapp:2018-07-03-08-25
-
cpe:2.3:a:wire:wire-webapp:2018-07-16-08-55
-
cpe:2.3:a:wire:wire-webapp:2018-07-16-14-05
-
cpe:2.3:a:wire:wire-webapp:2018-07-26-08-54
-
cpe:2.3:a:wire:wire-webapp:2018-08-06-08-03
-
cpe:2.3:a:wire:wire-webapp:2018-08-22-07-38
-
cpe:2.3:a:wire:wire-webapp:2018-08-31-06-54
-
cpe:2.3:a:wire:wire-webapp:2018-09-07-14-18
-
cpe:2.3:a:wire:wire-webapp:2018-09-28-11-46
-
cpe:2.3:a:wire:wire-webapp:2018-10-02-08-03
-
cpe:2.3:a:wire:wire-webapp:2018-10-15-08-14
-
cpe:2.3:a:wire:wire-webapp:2018-10-23-12-05
-
cpe:2.3:a:wire:wire-webapp:2018-11-05-11-21
-
cpe:2.3:a:wire:wire-webapp:2018-11-15-13-14
-
cpe:2.3:a:wire:wire-webapp:2018-11-30-11-03
-
cpe:2.3:a:wire:wire-webapp:2018-12-03-11-26
-
cpe:2.3:a:wire:wire-webapp:2018-12-04-14-24
-
cpe:2.3:a:wire:wire-webapp:2019-01-02-13-10
-
cpe:2.3:a:wire:wire-webapp:2019-01-08-13-20
-
cpe:2.3:a:wire:wire-webapp:2019-01-17-15-08
-
cpe:2.3:a:wire:wire-webapp:2019-02-11
-
cpe:2.3:a:wire:wire-webapp:2019-02-13
-
cpe:2.3:a:wire:wire-webapp:2019-02-18
-
cpe:2.3:a:wire:wire-webapp:2019-02-18-11-26
-
cpe:2.3:a:wire:wire-webapp:2019-02-27
-
cpe:2.3:a:wire:wire-webapp:2019-02-28
-
cpe:2.3:a:wire:wire-webapp:2019-02-28-15-10
-
cpe:2.3:a:wire:wire-webapp:2019-02-28-15-11
-
cpe:2.3:a:wire:wire-webapp:2019-03-05
-
cpe:2.3:a:wire:wire-webapp:2019-03-07
-
cpe:2.3:a:wire:wire-webapp:2019-03-11
-
cpe:2.3:a:wire:wire-webapp:2019-03-13
-
cpe:2.3:a:wire:wire-webapp:2019-03-14-11-05
-
cpe:2.3:a:wire:wire-webapp:2019-03-18-12-58
-
cpe:2.3:a:wire:wire-webapp:2019-03-20
-
cpe:2.3:a:wire:wire-webapp:2019-03-25
-
cpe:2.3:a:wire:wire-webapp:2019-03-28
-
cpe:2.3:a:wire:wire-webapp:2019-03-29-09-38
-
cpe:2.3:a:wire:wire-webapp:2019-04-08
-
cpe:2.3:a:wire:wire-webapp:2019-04-10-10-55
-
cpe:2.3:a:wire:wire-webapp:2019-04-11
-
cpe:2.3:a:wire:wire-webapp:2019-04-18
-
cpe:2.3:a:wire:wire-webapp:2019-04-23
-
cpe:2.3:a:wire:wire-webapp:2019-04-23-10-51
-
cpe:2.3:a:wire:wire-webapp:2019-04-25
-
cpe:2.3:a:wire:wire-webapp:2019-04-29
-
cpe:2.3:a:wire:wire-webapp:2019-05-09-09-36
-
cpe:2.3:a:wire:wire-webapp:2019-05-14
-
cpe:2.3:a:wire:wire-webapp:2019-05-15
-
cpe:2.3:a:wire:wire-webapp:2019-05-16
-
cpe:2.3:a:wire:wire-webapp:2019-05-16-09-26
-
cpe:2.3:a:wire:wire-webapp:2019-05-31
-
cpe:2.3:a:wire:wire-webapp:2019-05-31-08-18
-
cpe:2.3:a:wire:wire-webapp:2019-06-04
-
cpe:2.3:a:wire:wire-webapp:2019-06-06-12-31
-
cpe:2.3:a:wire:wire-webapp:2019-06-20
-
cpe:2.3:a:wire:wire-webapp:2019-06-24
-
cpe:2.3:a:wire:wire-webapp:2019-06-25
-
cpe:2.3:a:wire:wire-webapp:2019-06-26
-
cpe:2.3:a:wire:wire-webapp:2019-07-01
-
cpe:2.3:a:wire:wire-webapp:2019-07-02-12-29
-
cpe:2.3:a:wire:wire-webapp:2019-07-11-13-18
-
cpe:2.3:a:wire:wire-webapp:2019-07-30
-
cpe:2.3:a:wire:wire-webapp:2019-08-01
-
cpe:2.3:a:wire:wire-webapp:2019-08-14
-
cpe:2.3:a:wire:wire-webapp:2019-08-19
-
cpe:2.3:a:wire:wire-webapp:2019-08-21
-
cpe:2.3:a:wire:wire-webapp:2019-08-22
-
cpe:2.3:a:wire:wire-webapp:2019-08-27
-
cpe:2.3:a:wire:wire-webapp:2019-09-02
-
cpe:2.3:a:wire:wire-webapp:2019-09-05
-
cpe:2.3:a:wire:wire-webapp:2019-09-09
-
cpe:2.3:a:wire:wire-webapp:2019-09-12
-
cpe:2.3:a:wire:wire-webapp:2019-09-13
-
cpe:2.3:a:wire:wire-webapp:2019-09-17
-
cpe:2.3:a:wire:wire-webapp:2019-09-18
-
cpe:2.3:a:wire:wire-webapp:2019-09-23
-
cpe:2.3:a:wire:wire-webapp:2019-09-24
-
cpe:2.3:a:wire:wire-webapp:2019-10-07
-
cpe:2.3:a:wire:wire-webapp:2019-10-08
-
cpe:2.3:a:wire:wire-webapp:2019-10-10
-
cpe:2.3:a:wire:wire-webapp:2019-10-14
-
cpe:2.3:a:wire:wire-webapp:2019-10-16
-
cpe:2.3:a:wire:wire-webapp:2019-10-21
-
cpe:2.3:a:wire:wire-webapp:2019-10-25
-
cpe:2.3:a:wire:wire-webapp:2019-10-29
-
cpe:2.3:a:wire:wire-webapp:2019-10-31
-
cpe:2.3:a:wire:wire-webapp:2019-11-01
-
cpe:2.3:a:wire:wire-webapp:2019-11-08
-
cpe:2.3:a:wire:wire-webapp:2019-11-12
-
cpe:2.3:a:wire:wire-webapp:2019-11-19
-
cpe:2.3:a:wire:wire-webapp:2019-11-21
-
cpe:2.3:a:wire:wire-webapp:2019-11-25
-
cpe:2.3:a:wire:wire-webapp:2019-11-26
-
cpe:2.3:a:wire:wire-webapp:2019-12-12
-
cpe:2.3:a:wire:wire-webapp:2019-12-20
-
cpe:2.3:a:wire:wire-webapp:2020-01-06
-
cpe:2.3:a:wire:wire-webapp:2020-01-09
-
cpe:2.3:a:wire:wire-webapp:2020-01-13
-
cpe:2.3:a:wire:wire-webapp:2020-01-15
-
cpe:2.3:a:wire:wire-webapp:2020-01-16
-
cpe:2.3:a:wire:wire-webapp:2020-01-17
-
cpe:2.3:a:wire:wire-webapp:2020-01-21
-
cpe:2.3:a:wire:wire-webapp:2020-01-22
-
cpe:2.3:a:wire:wire-webapp:2020-02-06
-
cpe:2.3:a:wire:wire-webapp:2020-02-11
-
cpe:2.3:a:wire:wire-webapp:2020-02-14
-
cpe:2.3:a:wire:wire-webapp:2020-02-18
-
cpe:2.3:a:wire:wire-webapp:2020-02-20
-
cpe:2.3:a:wire:wire-webapp:2020-02-24
-
cpe:2.3:a:wire:wire-webapp:2020-02-26
-
cpe:2.3:a:wire:wire-webapp:2020-02-28
-
cpe:2.3:a:wire:wire-webapp:2020-03-03
-
cpe:2.3:a:wire:wire-webapp:2020-03-06
-
cpe:2.3:a:wire:wire-webapp:2020-03-12
-
cpe:2.3:a:wire:wire-webapp:2020-03-18
-
cpe:2.3:a:wire:wire-webapp:2020-03-20
-
cpe:2.3:a:wire:wire-webapp:2020-03-23
-
cpe:2.3:a:wire:wire-webapp:2020-03-30
-
cpe:2.3:a:wire:wire-webapp:2020-04-01
-
cpe:2.3:a:wire:wire-webapp:2020-04-07
-
cpe:2.3:a:wire:wire-webapp:2020-04-09
-
cpe:2.3:a:wire:wire-webapp:2020-04-16
-
cpe:2.3:a:wire:wire-webapp:2020-04-21
-
cpe:2.3:a:wire:wire-webapp:2020-04-22
-
cpe:2.3:a:wire:wire-webapp:2020-04-23
-
cpe:2.3:a:wire:wire-webapp:2020-04-28
-
cpe:2.3:a:wire:wire-webapp:2020-04-29
-
cpe:2.3:a:wire:wire-webapp:2020-05-04
-
cpe:2.3:a:wire:wire-webapp:2020-05-06
-
cpe:2.3:a:wire:wire-webapp:2020-05-07
-
cpe:2.3:a:wire:wire-webapp:2020-05-13
-
cpe:2.3:a:wire:wire-webapp:2020-05-14
-
cpe:2.3:a:wire:wire-webapp:2020-05-15
-
cpe:2.3:a:wire:wire-webapp:2020-05-18
-
cpe:2.3:a:wire:wire-webapp:2020-05-19
-
cpe:2.3:a:wire:wire-webapp:2020-05-20
-
cpe:2.3:a:wire:wire-webapp:2020-05-22
-
cpe:2.3:a:wire:wire-webapp:2020-05-26
-
cpe:2.3:a:wire:wire-webapp:2020-05-27
-
cpe:2.3:a:wire:wire-webapp:2020-05-28
-
cpe:2.3:a:wire:wire-webapp:2020-05-29
-
cpe:2.3:a:wire:wire-webapp:2020-06-02
-
cpe:2.3:a:wire:wire-webapp:2020-06-05
-
cpe:2.3:a:wire:wire-webapp:2020-06-08
-
cpe:2.3:a:wire:wire-webapp:2020-06-10
-
cpe:2.3:a:wire:wire-webapp:2020-06-12
-
cpe:2.3:a:wire:wire-webapp:2020-06-15
-
cpe:2.3:a:wire:wire-webapp:2020-06-19
-
cpe:2.3:a:wire:wire-webapp:2020-06-24
-
cpe:2.3:a:wire:wire-webapp:2020-06-29
-
cpe:2.3:a:wire:wire-webapp:2020-07-07
-
cpe:2.3:a:wire:wire-webapp:2020-07-13
-
cpe:2.3:a:wire:wire-webapp:2020-07-16
-
cpe:2.3:a:wire:wire-webapp:2020-07-24
-
cpe:2.3:a:wire:wire-webapp:2020-08-06
-
cpe:2.3:a:wire:wire-webapp:2020-08-12
-
cpe:2.3:a:wire:wire-webapp:2020-08-14
-
cpe:2.3:a:wire:wire-webapp:2020-08-18
-
cpe:2.3:a:wire:wire-webapp:2020-08-19
-
cpe:2.3:a:wire:wire-webapp:2020-08-21
-
cpe:2.3:a:wire:wire-webapp:2020-08-25
-
cpe:2.3:a:wire:wire-webapp:2020-08-26
-
cpe:2.3:a:wire:wire-webapp:2020-09-02
-
cpe:2.3:a:wire:wire-webapp:2020-09-03
-
cpe:2.3:a:wire:wire-webapp:2020-09-04
-
cpe:2.3:a:wire:wire-webapp:2020-09-08
-
cpe:2.3:a:wire:wire-webapp:2020-09-11
-
cpe:2.3:a:wire:wire-webapp:2020-09-17
-
cpe:2.3:a:wire:wire-webapp:2020-09-18
-
cpe:2.3:a:wire:wire-webapp:2020-09-21
-
cpe:2.3:a:wire:wire-webapp:2020-09-28
-
cpe:2.3:a:wire:wire-webapp:2020-09-29
-
cpe:2.3:a:wire:wire-webapp:2020-10-01
-
cpe:2.3:a:wire:wire-webapp:2020-10-06
-
cpe:2.3:a:wire:wire-webapp:2020-10-07
-
cpe:2.3:a:wire:wire-webapp:2020-10-08
-
cpe:2.3:a:wire:wire-webapp:2020-10-14
-
cpe:2.3:a:wire:wire-webapp:2020-10-15
-
cpe:2.3:a:wire:wire-webapp:2020-10-21
-
cpe:2.3:a:wire:wire-webapp:2020-10-26
-
cpe:2.3:a:wire:wire-webapp:2020-10-27
-
cpe:2.3:a:wire:wire-webapp:2020-10-28
-
cpe:2.3:a:wire:wire-webapp:2020-11-09
-
cpe:2.3:a:wire:wire-webapp:2020-11-30
-
cpe:2.3:a:wire:wire-webapp:2020-12-10
-
cpe:2.3:a:wire:wire-webapp:2020-12-14
-
cpe:2.3:a:wire:wire-webapp:2021-01-18
-
cpe:2.3:a:wire:wire-webapp:2021-01-27
-
cpe:2.3:a:wire:wire-webapp:2021-02-02
-
cpe:2.3:a:wire:wire-webapp:2021-02-03
-
cpe:2.3:a:wire:wire-webapp:2021-02-04
-
cpe:2.3:a:wire:wire-webapp:2021-02-15
-
cpe:2.3:a:wire:wire-webapp:2021-02-17
-
cpe:2.3:a:wire:wire-webapp:2021-02-18
-
cpe:2.3:a:wire:wire-webapp:2021-02-22
-
cpe:2.3:a:wire:wire-webapp:2021-02-26
-
cpe:2.3:a:wire:wire-webapp:2021-03-04
-
cpe:2.3:a:wire:wire-webapp:2021-03-05
-
cpe:2.3:a:wire:wire-webapp:2021-03-10
-
cpe:2.3:a:wire:wire-webapp:2021-03-15