PT-2024-13252 · Unknown · Tamaki Hamanoki Line

Published 2024-01-03 · Updated 2024-01-10 · CVE-2023-45559

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tamaki hamanoki Line version 13.6.1

Description An issue in Tamaki hamanoki Line allows attackers to send crafted notifications via leakage of the channel access token. This enables attackers to potentially exploit the system by sending unauthorized notifications.

Recommendations For version 13.6.1, consider restricting access to the notification system until a patch is available. As a temporary workaround, avoid using the channel access token in sensitive operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2023-45559

Affected Products

Tamaki Hamanoki Line

References · 9

• 🔥 https://github.com/syz913/CVE-reports/blob/main/CVE-2023-45559.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-45559 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45559 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1742599258925158697 · Twitter Post
• https://t.me/cvenotify/66077 · Telegram Post
• https://twitter.com/Esparta6108713/status/1742572907350614138 · Twitter Post
• https://twitter.com/CVEnew/status/1742553891672047958 · Twitter Post
• https://t.me/cibsecurity/74321 · Telegram Post
• http://tamakihamanoki.com · Note