Medium severity · published Dec 10, 2018
CVE-2018-3988
Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attach file" menu, then…
4.7
CVSS
0.5%
EPSS
No
On KEV
Description
Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attach file" menu, then Signal will leave the picture in its own cache directory, which is available to any application on the system.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
Private Messenger · Signal
4.24.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-3988
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-3988
Broken Link
http://www.securityfocus.com/bid/106207
Exploit
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0656
More from Private Messenger
9.8
CVE-2019-17192
The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to answer a call, which…
7.5
CVE-2019-17191
The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a connect message
6.5
CVE-2019-9970
Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when…
5.3
CVE-2020-5753
Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to…