PT-2020-16227 · Telegram+1 · Telegram Desktop+1

Soheil Samanabadi · Published 2020-10-14 · Updated 2021-07-21 · CVE-2020-25824

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Low

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Telegram Desktop versions 2.4.3 and earlier

Description The issue allows an attacker to access all chat conversations and media files without requiring a passcode when the Export key is pushed within the Export Telegram Data wizard. This can happen if the victim has opened the Export Wizard and is then distracted, leaving the desktop unattended. The attacker can then push the Export key to gain access to sensitive data.

Recommendations For Telegram Desktop versions 2.4.3 and earlier, as a temporary workaround, consider disabling the Export Telegram Data wizard until a patch is available. Restrict access to the Export key within the wizard to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

ALT-PU-2020-3181

CVE-2020-25824

Affected Products

Alt Linux

Telegram Desktop

References · 7

• 🔥 https://github.com/soheilsamanabadi/vulnerability/blob/main/Telegram-Desktop-CVE-2020-25824 · Exploit
• https://osv.dev/vulnerability/CVE-2020-25824 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25824 · Security Note
• https://security.gentoo.org/glsa/202101-34 · Vendor Advisory
• https://github.com/telegramdesktop/tdesktop/releases/tag/v2.4.3 · Note
• https://t.me/cvenotify/9052 · Telegram Post
• https://telegram.org · Note