Telegram CVE-2023-34658

MEDIUM

Improper Restriction of Rendered UI Layers or Frames (CWE-1021)

2023-06-29 cve@mitre.org

Apple XSS Telegram

5.3

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

1

CVE Published

Jun 29, 2023 - 17:15 nvd

MEDIUM 5.3

DescriptionNVD

Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController.

AnalysisAI

Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1021. Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController. Affected products include: Telegram.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Telegram

View all

CVE-2019-10044 HIGH This Week POC

Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to a

CVE-2018-20436 HIGH This Week POC

The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests

CVE-2021-31321 HIGH This Week POC

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the

CVE-2021-31320 HIGH This Week POC

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the

CVE-2022-43363 MEDIUM This Month POC

Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. Rated medium severity (C

CVE-2021-30496 MEDIUM This Month POC

The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the

CVE-2023-26818 MEDIUM This Month POC

Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT

CVE-2021-31323 MEDIUM This Month POC

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the

CVE-2021-31322 MEDIUM This Month POC

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the

CVE-2021-31319 MEDIUM This Month POC

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LO

CVE-2021-31318 MEDIUM This Month POC

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCo

CVE-2021-31317 MEDIUM This Month POC

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDash

Same weakness CWE-1021 – Improper Restriction of Rendered UI Layers or Frames

View all

CVE-2022-3167 HIGH POC

CVE-2021-3734 HIGH POC

CVE-2019-16371 HIGH POC

CVE-2024-33377 HIGH POC

CVE-2020-13119 HIGH POC

CVE-2022-1803 MEDIUM POC

CVE-2024-2177 MEDIUM POC

CVE-2024-4950 MEDIUM POC

Same technique XSS

View all

CVE-2017-9248 CRITICAL POC

CVE-2013-1710 CRITICAL POC

CVE-2013-7389 MEDIUM POC

CVE-2021-25299 MEDIUM POC

CVE-2014-2120 MEDIUM

CVE-2023-40000 HIGH POC

CVE-2024-52875 HIGH POC

CVE-2016-8581 MEDIUM POC

Share

CVE-2023-34658 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy