CVE-2023-24069

Katalog CVE

CVSS 3.3 · Low EPSS 0,86%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada signal-desktop. Skor CVSS 3.1 3.3 (Low) menurut NVD.

Deskripsi (NVD)

Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages from the attachments.noindex directory. Cached attachments are not effectively cleared. In some cases, even after a self-initiated file deletion, an attacker can still recover the file if it was previously replied to in a conversation. (Local filesystem access is needed by the attacker.) NOTE: the vendor disputes the relevance of this finding because the product is not intended to protect against adversaries with this degree of local access.

Rincian

Terbit di NVD

23 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.3 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,86% peluang dieksploitasi; lebih tinggi dari 57,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://signal.org/download/linux product · advisory vendor
• https://signal.org/download/macos product · advisory vendor
• https://signal.org/en/download/windows product · advisory vendor
• https://johnjhacking.com/blog/cve-2023-24068-cve-2023-24069/ exploit · advisory pihak ketiga