Current Description
An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0. The "Secret Chats" functionality allows a user to delete all traces of a chat, either by using a time trigger or by direct request. There is a bug in this functionality that leaves behind photos taken and shared on the secret chats, even after the chats are deleted. These photos will be stored in the device and accessible to all applications installed on the Android device.
Source:
MITRE
View Analysis Description
Analysis Description
An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0. The "Secret Chats" functionality allows a user to delete all traces of a chat, either by using a time trigger or by direct request. There is a bug in this functionality that leaves behind photos taken and shared on the secret chats, even after the chats are deleted. These photos will be stored in the device and accessible to all applications installed on the Android device.
Source:
MITRE
Severity
CVSS 3.x Severity and Metrics:
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 Severity and Metrics:
Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N)
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because
they may have information that would be of interest to you. No inferences should be drawn on account of other sites
being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose.
NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further,
NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about
this page to nvd@nist.gov.
Weakness Enumeration
| CWE-ID |
CWE Name |
Source |
| CWE-200 |
Information Exposure |
NIST
|
Change History
2 change records found
- show changes
Initial Analysis -
2/4/2019 11:33:38 AM
| Action |
Type |
Old Value |
New Value |
| Added |
CPE Configuration |
|
OR
*cpe:2.3:a:telegram:telegram:4.9.0:*:*:*:*:android:*:* |
| Added |
CVSS V2 |
|
(AV:L/AC:L/Au:N/C:P/I:N/A:N) |
| Added |
CVSS V3 |
|
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| Added |
CWE |
|
CWE-200 |
| Changed |
Reference Type |
http://www.securityfocus.com/bid/106295 No Types Assigned |
http://www.securityfocus.com/bid/106295 Third Party Advisory, VDB Entry |
| Changed |
Reference Type |
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0654 No Types Assigned |
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0654 Third Party Advisory |
CVE Modified by MITRE -
1/4/2019 6:29:01 AM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
|
http://www.securityfocus.com/bid/106295 [No Types Assigned] |