P2P Connection Vulnerability in Telegram Desktop and Windows App
CVE-2018-17780

6.5MEDIUM

Key Information:

Vendor

Telegram

Status
Telegram Desktop
Telegram Messenger
Vendor
CVE Published:
29 September 2018

What is CVE-2018-17780?

A vulnerability in Telegram Desktop versions 1.3.14 and Telegram for WP8.1 allows for the exposure of users' public and private IP addresses during calls. This occurs due to an insecure default setting that permits P2P connections from clients not included in the user's 'My Contacts' list, potentially allowing unauthorized entities to discover the user's location. This behavior raises significant privacy concerns for users relying on Telegram for secure communication.

References

http://www.securityfocus.com/bid/105521
vdb-entryx_refsource_BID
https://www.inputzero.io/2018/09/bug-bounty-telegram-cve-...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.