CVE-2017-17715
High
Description
The saveFile method in MediaController.java in the Telegram Messenger application before 2017-12-08 for Android allows directory traversal via a pathname obtained in a file-transfer request from a remote peer, as demonstrated by writing to tgnet.dat or tgnet.dat.bak.
SeverityHigh
CVSS8.8
Exploit probability—
ProductTelegram Messenger
PublishedDec 16, 2017
First seenDec 16, 2017
How to fix
Update
- telegram telegram_messenger2017-12-08 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| telegram telegram_messenger | v < 2017-12-08 | 2017-12-08 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.