PT-2018-14085 · Telegram+1 · Telegram Desktop+1

Dhiraj Mishra · Publicado 2018-09-28 · Atualizado 2019-10-03 · CVE-2018-17613

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Telegram Desktop (aka tdesktop) version 1.3.16 alpha

Description The issue concerns the transmission of sensitive data in cleartext when a specific setting is enabled. Specifically, when "Use proxy" is enabled, credentials and application data are sent in cleartext over the SOCKS5 protocol.

Recommendations For Telegram Desktop (aka tdesktop) version 1.3.16 alpha, consider disabling the "Use proxy" setting until a fix is available to prevent credentials and application data from being sent in cleartext.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2018-17613

Produtos afetados

Debian

Telegram Desktop

Referências · 9

• https://osv.dev/vulnerability/DEBIAN-CVE-2018-17613 · Aviso do Fabricante
• https://seclists.org/oss-sec/2018/q3/280 · Nota
• https://osv.dev/vulnerability/CVE-2018-17613 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-17613 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17613 · Nota de Segurança
• https://inputzero.io/2018/09/telegram-share-password-in-cleartext.html · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-17613 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-17613 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2018-17613 · Aviso do Fabricante