Skip to content

Entering code in App Lock modal sends input to conversation

High
franziskuskiefer published GHSA-cxwr-f2j3-q8hp Mar 24, 2021

Package

wire-webapp

Affected versions

< 2021-03-15-production.0

Patched versions

2021-03-15-production.0

Description

When being prompted to enter the app-lock passphrase, the typed passphrase will be sent into the most recently used chat when the user does not actively give focus to the input field.

Patches

Input element focus is enforced programatically: #10704

Workarounds

The user must make sure to focus the input field before entering the app-lock passphrase.

Severity

High

CVE ID

CVE-2021-21400

Weaknesses

No CWEs