PT-2019-14598 · Telegram · Telegram

Dhiraj Mishra · Published 2019-09-11 · Updated 2021-10-18 · CVE-2019-16248

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Telegram versions prior to 5.11

Description The issue concerns the "delete for" feature, which does not properly delete shared media files from the Telegram Images directory on Android devices. This can lead to a misleading user interface indication that a sender has removed a recipient's copy of a previously sent image, when in fact the image remains accessible.

Recommendations For versions prior to 5.11, update to version 5.11 or later to ensure that the "delete for" feature functions as intended and properly removes shared media files from the Telegram Images directory.

Exploit

Fix

Related Identifiers

CVE-2019-16248

Affected Products

Telegram

References · 6

• 🔥 https://inputzero.io/2019/09/telegram-privacy-fails-again.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-16248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16248 · Security Note
• https://github.com/RootUp/PersonalStuff/blob/master/Telegram_Privacy.pdf · Note
• https://openwall.com/lists/oss-security/2019/09/09/2 · Note
• https://t.me/cvenotify/22174 · Telegram Post