CVE-2021-21400 - CVE House
Back to Database
Status published High CVE-2021-21400

Entering code in App Lock modal sends input to conversation

Vulnerability Description

wire-webapp is an open-source front end for Wire, a secure collaboration platform. In wire-webapp before version 2021-03-15-production.0, when being prompted to enter the app-lock passphrase, the typed passphrase will be sent into the most recently used chat when the user does not actively give focus to the input field. Input element focus is enforced programatically in version 2021-03-15-production.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-21400

Credits & Attribution

No credits recorded in the NVD database.

References

More from wireapp

View All →
CVE-2025-49846
wire-ios accidentally logs message contents
Medium 4.1
CVE-2025-48066
wire-webapp has no database deletion on client logout
Medium 6
CVE-2025-48061
wire-webapp Has Insufficient Session Invalidation after User Logout
Medium 5.6
CVE-2023-48221
wire-avs remote format string vulnerability
High 7.3
CVE-2023-22737
wire-server vulnerable to unauthorized removal of Bots from Conversations
Medium 6.5

Affected Vendor

Affected Software

wire-webapp
Vulnerable Versions:
< 2021-03-15-production.0

Timeline

Official Publish: April 2nd, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration