Medium severity · published Jan 3, 2019
CVE-2018-3986
An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0
5.5
CVSS
0.4%
EPSS
No
On KEV
Description
An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0. The "Secret Chats" functionality allows a user to delete all traces of a chat, either by using a time trigger or by direct request. There is a bug in this functionality that leaves behind photos taken and shared on the secret chats, even after the chats are deleted. These photos will be stored in the device and accessible to all applications installed on the Android device.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
Telegram · Telegram
4.9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-3986
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-3986
Broken Link
http://www.securityfocus.com/bid/106295
Exploit
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0654
More from Telegram
8.8
CVE-2019-10044
Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing…
8.1
CVE-2024-7014
Improper multimedia file attachment validation in Telegram for Android app
8.1
CVE-2018-20436
The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed while composing a chat message, before that…
7.1
CVE-2021-31321
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the gray_split_cubic function of their custom fork of the…
7.1
CVE-2021-31320
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the VGradientCache::generateGradientColorTable function of…