CVE-2021-32750

    Dashboard / Vulnerabilities / CVE-2021-32750

    CVE-2021-32750

    Published: 15 Jul 2021Last Modified: 9 Jul 2026

    Summary:

    Details: MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop client prior to version 0.8.8 can be de-anonymized by an attacker who knows their full ID. An attacker could send a message with a subject line containing a URL with an HTML image tag and the MuWire client would try to fetch that image via clearnet, thus exposing the IP address of the user. The problem is fixed in MuWire 0.8.8. As a workaround, users can disable messaging functionality to prevent other users from sending them malicious messages.

    References: https://github.com/zlatinb/muwire/security/advisories/GHSA-68xh-9h7w-64qg

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -5f229d903f09e12f6bbae31b8aab3440e58ec730

    Affected versions

    muwire-0.8.7
    muwire-0.8.6
    muwire-0.8.5
    muwire-0.8.4
    muwire-0.8.3
    muwire-0.8.2
    muwire-0.8.1
    muwire-0.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-32750 | CVE-DB