Vulnerability · NVD

CVE-2018-3986

CVE-2018-3986, medium severity (CVSS 5.5): 1 tracked app concerned, all fixed or indeterminable on their current version.

Severity (CVSS): 5.5
Exploitation: 0.4 %
Tracked apps: 1
Still exposed: 0

Published on 2019-01-03

An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0. The "Secret Chats" functionality allows a user to delete all traces of a chat, either by using a time trigger or by direct request. There is a bug in this functionality that leaves behind photos taken and shared on the secret chats, even after the chats are deleted. These photos will be stored in the device and accessible to all applications installed on the Android device.

Attack vector : Local No user interaction

Show raw CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS 0.43% exploit very unlikely percentile 34.4%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

Telegram Android org.telegram.messenger

Affected - Fixed in - Latest tracked 12.10.1 undetermined

Vulnerable CPE configurations (1)

Vendor	Product	Platform	Versions	CPE 2.3 URI
telegram	telegram Android	Android	-	cpe:2.3:a:telegram:telegram:4.9.0:::::android::

View on NVD ↗

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM