Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-43992
CVE-2023-43992:
NixOS vulnerability analysis and mitigation
Overview
An issue in STOCKMAN GROUP mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications through the exposure of the channel access token. The vulnerability was discovered in the mini-app that is accessible through Line's platform via the URL https://liff.line.me/1657580646-WqQoQn4m. This security flaw is classified as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) (GitHub Report).
Technical details
The vulnerability exists in the response of the request to www.l-members.me/miniapp/members_card, which exposes the channel access token. This token is a critical credential used for securing communication channels within Line. The channel access token is exposed in the client-side response, making it accessible to potential attackers. The token can be used with the API endpoint https://api.line.me/message/v3/notifier/token through the Authorization header (GitHub Report). The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) (NVD).
Impact
The exposure of the channel access token allows attackers to broadcast malicious messages through the Line platform. This can result in users receiving unauthorized communications including malicious website links and fraudulent information. The vulnerability affects all users of the STOCKMAN GROUP mini-app (GitHub Report).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management