Resource management error in Telegram for Android - CVE-2019-16248
Published: September 17, 2019
Vulnerability identifier: #VU21164
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2019-16248
CWE-ID: CWE-399
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Telegram
Affected software:
Telegram for Android
Telegram for Android
Detailed vulnerability description
The vulnerability allows an attacker to bypass certain security restrictions.
The vulnerability exists due "delete for" feature does not delete images and media files from the Telegram Images directory, removing them from the chat window only. As a result, it is possible to gain access to files that were deleted via the UI interface.
How to mitigate CVE-2019-16248
Install updates from vendor's website.