Cleartext Credentials Transmission in Telegram Desktop by Telegram
CVE-2018-17613

9.8CRITICAL

Key Information:

Vendor

Telegram

Status
Telegram Desktop
Vendor
CVE Published:
28 September 2018
đź”” Create Telegram Vulnerability Alert

What is CVE-2018-17613?

The Telegram Desktop application, specifically version 1.3.16 alpha, exhibits a vulnerability where enabling the 'Use proxy' feature results in sensitive credentials and application data being transmitted unencrypted over the SOCKS5 protocol. This flaw poses a significant risk of interception by malicious actors, potentially leading to unauthorized access to user accounts and exposed personal information. Users of this version are advised to disable the proxy feature or upgrade to a patched version to mitigate these risks.

References

https://seclists.org/oss-sec/2018/q3/280
x_refsource_MISC
https://www.inputzero.io/2018/09/telegram-share-password-...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.