CVE-2024-7014
Improper multimedia file attachment validation in Telegram for Android app
Severity Score
7.1
*CVSS v4
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track
*SSVC
Descriptions
EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting
versions 10.14.4 and older.
La vulnerabilidad de EvilVideo permite enviar aplicaciones maliciosas disfrazadas de videos en la aplicaciĆ³n Telegram para Android que afecta las versiones 10.14.4 y anteriores.
*Credits:
Lukas Stefanko, ESET
CVSS Scores
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
System
Vulnerable | Subsequent
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-07-23 CVE Reserved
- 2024-07-23 CVE Published
- 2024-07-24 EPSS Updated
- 2024-08-01 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
- CAPEC-698: Install Malicious Extension
References (1)
URL | Tag | Source |
---|---|---|
https://www.welivesecurity.com/en/eset-research/cursed-tapes-exploiting-evilvideo-vulnerability-telegram-android |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Android Search vendor "Android" | Telegram For Android Search vendor "Android" for product "Telegram For Android" | <= 10.14.4 Search vendor "Android" for product "Telegram For Android" and version " <= 10.14.4" | en |
Affected
|