PT-2023-28772 · Line · Park Dandan Mini-App+1

Published 2023-12-07 · Updated 2024-05-04 · CVE-2023-43304

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Line version 13.6.1

Description An issue in the PARK DANDAN mini-app on Line allows attackers to send crafted malicious notifications via leakage of the channel access token.

Recommendations For Line version 13.6.1, consider disabling the PARK DANDAN mini-app until a patch is available to prevent the leakage of the channel access token and mitigate the risk of malicious notifications.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2023-43304

Affected Products

Line

Park Dandan Mini-App

References · 7

• 🔥 https://github.com/syz913/CVE-reports/blob/main/CVE-2023-43304.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-43304 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43304 · Vendor Advisory
• https://t.me/cvenotify/62671 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1732729219438858375 · Twitter Post
• https://twitter.com/CVEnew/status/1732659832505684266 · Twitter Post
• https://twitter.com/KulinskiArkadi/status/1786809578069381278 · Twitter Post