// For flags

CVE-2024-5739

 

Severity Score

6.4
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

The in-app browser of LINE client for iOS versions below 14.9.0 contains a Universal XSS (UXSS) vulnerability. This vulnerability allows for cross-site scripting (XSS) where arbitrary JavaScript can be executed in the top frame from an embedded iframe on any displayed web site within the in-app browser. The in-app browser is usually opened by tapping on URLs contained in chat messages, and for the attack to be successful, the victim must trigger a click event on a malicious iframe. If an iframe embedded in any website can be controlled by an attacker, this vulnerability could be exploited to capture or alter content displayed in the top frame, as well as user session information. This vulnerability affects LINE client for iOS versions below 14.9.0 and does not affect other LINE clients such as LINE client for Android. Please update LINE client for iOS to version 14.9.0 or higher.

El navegador integrado en la aplicación del cliente LINE para versiones de iOS inferiores a 14.9.0 contiene una vulnerabilidad Universal XSS (UXSS). Esta vulnerabilidad permite cross-site scripting (XSS), donde se puede ejecutar JavaScript arbitrario en el framework superior desde un iframe incrustado en cualquier sitio web mostrado dentro del navegador de la aplicación. El navegador de la aplicación generalmente se abre tocando las URL contenidas en los mensajes de chat y, para que el ataque tenga éxito, la víctima debe activar un evento de clic en un iframe malicioso. Si un atacante puede controlar un iframe incrustado en cualquier sitio web, esta vulnerabilidad podría aprovecharse para capturar o alterar el contenido que se muestra en el framework superior, así como la información de la sesión del usuario. Esta vulnerabilidad afecta al cliente LINE para versiones de iOS inferiores a 14.9.0 y no afecta a otros clientes LINE, como el cliente LINE para Android. Actualice el cliente LINE para iOS a la versión 14.9.0 o superior.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
Active
System
Vulnerable | Subsequent
Confidentiality
Low
High
Integrity
Low
High
Availability
None
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-06-07 CVE Reserved
  • 2024-06-12 CVE Published
  • 2024-06-13 EPSS Updated
  • 2024-08-01 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
References (1)
URL Tag Source
https://hackerone.com/reports/2284129
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
LINE Corporation
Search vendor "LINE Corporation"
 LINE Client For IOS
Search vendor "LINE Corporation" for product "LINE Client For IOS"
 >= 14.0.0 < 14.9.0
Search vendor "LINE Corporation" for product "LINE Client For IOS" and version " >= 14.0.0 < 14.9.0"
en
Affected