CVE-2023-24069: Infoleak
First published: Mon Jan 23 2023(Updated: )
** DISPUTED ** Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages from the attachments.noindex directory. Cached attachments are not effectively cleared. In some cases, even after a self-initiated file deletion, an attacker can still recover the file if it was previously replied to in a conversation. (Local filesystem access is needed by the attacker.) NOTE: the vendor disputes the relevance of this finding because the product is not intended to protect against adversaries with this degree of local access.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Signal Signal-desktop | <=6.2.0 | |
| Apple macOS | ||
| Linux Linux kernel | ||
| Microsoft Windows | ||
| All of | ||
| Signal Signal-desktop | <=6.2.0 | |
| Any of | ||
| Apple macOS | ||
| Linux Linux kernel | ||
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-24069.
What is the severity of CVE-2023-24069?
The severity of CVE-2023-24069 is low (3.3).
Which software versions are affected by CVE-2023-24069?
Signal Desktop versions before 6.2.0 on Windows, Linux, and macOS are affected.
How can an attacker exploit CVE-2023-24069?
An attacker can exploit CVE-2023-24069 to obtain potentially sensitive attachments sent in messages from the attachments.noindex directory.
Is there a fix available for CVE-2023-24069?
Yes, updating Signal Desktop to version 6.2.0 or later will fix CVE-2023-24069.
- collector/nvd-index
- agent/references
- agent/type
- agent/author
- agent/severity
- agent/status
- agent/description
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/weakness
- agent/event
- agent/tags
- status/disputed
- vendor/signal
- canonical/signal signal-desktop
- version/signal signal-desktop/6.2.0
- vendor/apple
- canonical/apple macos
- vendor/linux
- canonical/linux linux kernel
- vendor/microsoft
- canonical/microsoft windows