Resource management error in Telegram for Android - CVE-2019-16248
Published: September 17, 2019
Vulnerability identifier: #VU21164
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-16248
CWE-ID: CWE-399
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker to bypass certain security restrictions.
The vulnerability exists due "delete for" feature does not delete images and media files from the Telegram Images directory, removing them from the chat window only. As a result, it is possible to gain access to files that were deleted via the UI interface.
Affected software
Telegram for Android
How to mitigate CVE-2019-16248
Install updates from vendor's website.
Telegram for Android - update to 5.11.0