Signal
CVE-2018-14023
MEDIUM
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage.
AnalysisAI
Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage. Affected products include: Signal Signal-Desktop. Version information: before 1.15.0.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.
Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within th
The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. Rated high severity (CVSS 7.5), this vulnerab
The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, witho
Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\n
js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL. Rated medium se
The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing
Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses th
The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to chec
Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments
The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feat
Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for
Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource location specified in an attribute of
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today