CVE-2019-16248

· MEDIUMModified

← All CVEs

CVSS v3.1

5.5

EPSS

0.44%

Published

Sep 11, 2019

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The "delete for" feature in Telegram before 5.11 on Android does not delete shared media files from the Telegram Images directory. In other words, there is a potentially misleading UI indication that a sender can remove a recipient's copy of a previously sent image (analogous to supported functionality in which a sender can remove a recipient's copy of a previously sent message).

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Products (1)

telegram · telegram (up to 5.11.0)vulnerable

References (6)

https://github.com/RootUp/PersonalStuff/blob/master/Telegram_Privacy.pdf

Third Party Advisory

https://www.inputzero.io/2019/09/telegram-privacy-fails-again.html

ExploitThird Party Advisory

https://www.openwall.com/lists/oss-security/2019/09/09/2

Mailing ListThird Party Advisory

https://github.com/RootUp/PersonalStuff/blob/master/Telegram_Privacy.pdf