Vulnerability · Published Oct 14, 2020 · Assigned by mitre

CVE-2020-25824

Low 2.4

In plain English

A low-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS NVD)2.4Low

Exploit odds (30 days)0.5%top 53.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. The threat model is a victim who has voluntarily opened Export Wizard but is then distracted. An attacker then approaches the unattended desktop and pushes the Export key. This attacker may consequently gain access to all chat conversation and media files.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.Telegram.org x_refsource_MISC
https://github.com/soheilsamanabadi/vulnerability/blob/main/Telegram-Desktop-CVE-2020-25824 x_refsource_MISC
https://github.com/telegramdesktop/tdesktop/releases/tag/v2.4.3 x_refsource_MISC
GLSA-202101-34 vendor-advisory, x_refsource_GENTOO