CVE-2021-32750
Last modified
CVE-2021-32750 is a medium-severity vulnerability rated 5.7/10 on the CVSS scale. MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop client prior to version 0.8.8 can be de-anonymized by an attacker who knows their full ID. EPSS estimates a 0.84% chance of exploitation in the next 30 days.
Description
MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop client prior to version 0.8.8 can be de-anonymized by an attacker who knows their full ID. An attacker could send a message with a subject line containing a URL with an HTML image tag and the MuWire client would try to fetch that image via clearnet, thus exposing the IP address of the user. The problem is fixed in MuWire 0.8.8. As a workaround, users can disable messaging functionality to prevent other users from sending them malicious messages.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Muwire Project | Muwire | < 0.8.8 |
References
- https://github.com/zlatinb/muwire/security/advisories/GHSA-68xh-9h7w-64qgExploit, Third Party Advisory
- https://github.com/zlatinb/muwire/security/advisories/GHSA-68xh-9h7w-64qgExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-32750?
How severe is CVE-2021-32750?
How do I fix CVE-2021-32750?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-32745Collabora Online is a collaborative online office suite. A r…6.1
- CVE-2021-32746Icinga Web 2 is an open source monitoring web interface, fra…5.3
- CVE-2021-32747Icinga Web 2 is an open source monitoring web interface, fra…6.5
- CVE-2021-32748Nextcloud Richdocuments in an open source self hosted online…4.3
- CVE-2021-32749fail2ban is a daemon to ban hosts that cause multiple authen…8.1
- CVE-2021-3275Unauthenticated stored cross-site scripting (XSS) exists in …6.1
- CVE-2021-32751Gradle is a build tool with a focus on build automation. In …7.5
- CVE-2021-32752Ether Logs is a package that allows one to check one's logs …4.9
- CVE-2021-32753EdgeX Foundry is an open source project for building a commo…6.5
- CVE-2021-32754FlowDroid is a data flow analysis tool. FlowDroid versions p…5.3
- CVE-2021-32755Wire is a collaboration platform. wire-ios-transport handles…4.3
- CVE-2021-32756ManageIQ is an open-source management platform. In versions …8.8
Are you affected by CVE-2021-32750?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST
