Medium severity · published Sep 11, 2019
CVE-2019-16248
The "delete for" feature in Telegram before 5.11 on Android does not delete shared media files from the Telegram Images directory
5.5
CVSS
0.4%
EPSS
No
On KEV
Description
The "delete for" feature in Telegram before 5.11 on Android does not delete shared media files from the Telegram Images directory. In other words, there is a potentially misleading UI indication that a sender can remove a recipient's copy of a previously sent image (analogous to supported functionality in which a sender can remove a recipient's copy of a previously sent message).
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
Telegram · Telegram
before 5.11.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-16248
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-16248
Third Party Advisory
https://github.com/RootUp/PersonalStuff/blob/master/Telegram_Privacy.pdf
Exploit
https://www.inputzero.io/2019/09/telegram-privacy-fails-again.html
Mailing List
https://www.openwall.com/lists/oss-security/2019/09/09/2
More from Telegram
8.8
CVE-2019-10044
Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing…
8.1
CVE-2024-7014
Improper multimedia file attachment validation in Telegram for Android app
8.1
CVE-2018-20436
The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed while composing a chat message, before that…
7.1
CVE-2021-31321
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the gray_split_cubic function of their custom fork of the…
7.1
CVE-2021-31320
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the VGradientCache::generateGradientColorTable function of…