CVE-2018-3987: Infoleak

Published Feb 12, 2020

Updated

An exploitable information disclosure vulnerability exists in the 'Secret Chats' functionality of Rakuten Viber on Android 9.3.0.6. The 'Secret Chats' functionality allows a user to delete all traces of a chat either by using a time trigger or by direct request. There is a bug in this functionality which leaves behind photos taken and shared on the secret chats, even after the chats are deleted. These photos will be stored in the device and accessible to all applications installed on the Android device.

Affected Software

1 affected component

Rakuten Viber Android=9.3.0.6

Event History

Feb 12, 2020

CVE Published

via MITRE·11:36 PM

Data Sourced

via MITRE·11:36 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2018-3987?

The severity of CVE-2018-3987 is medium.

What is the affected software of CVE-2018-3987?

The affected software of CVE-2018-3987 is Rakuten Viber version 9.3.0.6 on Android.

How can the 'Secret Chats' functionality be exploited in CVE-2018-3987?

An attacker can exploit the 'Secret Chats' functionality in CVE-2018-3987 to access sensitive information by causing an information disclosure vulnerability.

Is there a fix available for CVE-2018-3987?

Yes, a fix is available for CVE-2018-3987. Users should update to the latest version of Rakuten Viber to mitigate the vulnerability.

Where can I find more information about CVE-2018-3987?

You can find more information about CVE-2018-3987 at the following link: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0655