CVE-2019-15514

The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attackers can find these numbers via the Group Info feature, e.g., by adding a significant fraction of a region's assigned phone numbers.

CVSS v3.0

5.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

2.26% chance of exploitation in the next 30 days, 82th percentile

Published

2019-08-23

Updated

2024-08-05

Proof-of-concept exploits (3)

• https://docs.google.com/document/d/e/2PACX-1vRx2wO2kj0axlQtv2CDSjPGlRKJOHtucvpOKGFKybh2eV…
• Cyb3rDud3/RevalTeleNumbersCSV0★ · 2020-01-15
• bibi1959/CVE-2019-1551425★ · 2021-12-19

References

• CVE Record
• NVD entry

Related

• CVE-2019-15511
• CVE-2019-15532
• CVE-2019-15510
• CVE-2019-15575
• CVE-2019-15502
• CVE-2019-15576