CVE-2025-14023 - Vulnerability Details - OpenCVE

LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-app browser's user interface, which could create confusion about the trust context of displayed pages or interactive elements under specific conditions.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Apple	Ios
Linecorp	Line

No data.

No data.

References

Link	Providers
https://hackerone.com/reports/3260386

History

Mon, 15 Dec 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 15 Dec 2025 14:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios Linecorp Linecorp line
Vendors & Products		Apple Apple ios Linecorp Linecorp line

Mon, 15 Dec 2025 07:00:00 +0000

Type	Values Removed	Values Added
Description		LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-app browser's user interface, which could create confusion about the trust context of displayed pages or interactive elements under specific conditions.
References		https://hackerone.com/reports/3260386
Metrics		cvssV3_1 `{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: LY-Corporation

Published: 2025-12-15T06:45:23.025Z

Updated: 2025-12-15T18:25:28.317Z

Reserved: 2025-12-04T11:45:06.869Z

Link: CVE-2025-14023

Vulnrichment

Updated: 2025-12-15T18:22:57.853Z

NVD

Status : Undergoing Analysis

Published: 2025-12-15T07:15:51.110

Modified: 2025-12-15T19:16:02.593

Link: CVE-2025-14023

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14023", "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "state": "PUBLISHED", "assignerShortName": "LY-Corporation", "dateReserved": "2025-12-04T11:45:06.869Z", "datePublished": "2025-12-15T06:45:23.025Z", "dateUpdated": "2025-12-15T18:25:28.317Z"}, "containers": {"cna": {"affected": [{"vendor": "LINE Corporation", "product": "LINE client for iOS", "versions": [{"version": "14.0.0", "status": "affected", "versionType": "custom", "lessThan": "15.19"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "na"}]}], "descriptions": [{"lang": "en", "value": "LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-app browser's user interface, which could create confusion about the trust context of displayed pages or interactive elements under specific conditions."}], "references": [{"url": "https://hackerone.com/reports/3260386"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "exploitCodeMaturity": "NOT_DEFINED", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalScore": 3.1, "temporalSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NETWORK", "modifiedAttackComplexity": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedUserInteraction": "REQUIRED", "modifiedScope": "UNCHANGED", "modifiedConfidentialityImpact": "NONE", "modifiedIntegrityImpact": "LOW", "modifiedAvailabilityImpact": "NONE", "environmentalScore": 3.1, "environmentalSeverity": "LOW"}}], "providerMetadata": {"orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "shortName": "LY-Corporation", "dateUpdated": "2025-12-15T06:45:23.025Z"}}, "adp": [{"references": [{"url": "https://hackerone.com/reports/3260386", "tags": ["permissions-required"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T18:23:07.942451Z", "id": "CVE-2025-14023", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T18:25:28.317Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14023", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T18:23:07.942451Z"}}}], "references": [{"url": "https://hackerone.com/reports/3260386", "tags": ["permissions-required"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T18:22:57.853Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "modifiedScope": "UNCHANGED", "temporalScore": 3.1, "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "LOW", "availabilityImpact": "NONE", "environmentalScore": 3.1, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NETWORK", "confidentialityImpact": "NONE", "environmentalSeverity": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "LOW", "modifiedUserInteraction": "REQUIRED", "modifiedAttackComplexity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "NONE", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "LINE Corporation", "product": "LINE client for iOS", "versions": [{"status": "affected", "version": "14.0.0", "lessThan": "15.19", "versionType": "custom"}]}], "references": [{"url": "https://hackerone.com/reports/3260386"}], "descriptions": [{"lang": "en", "value": "LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-app browser's user interface, which could create confusion about the trust context of displayed pages or interactive elements under specific conditions."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "na"}]}], "providerMetadata": {"orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "shortName": "LY-Corporation", "dateUpdated": "2025-12-15T06:45:23.025Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14023", "state": "PUBLISHED", "dateUpdated": "2025-12-15T18:25:28.317Z", "dateReserved": "2025-12-04T11:45:06.869Z", "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "datePublished": "2025-12-15T06:45:23.025Z", "assignerShortName": "LY-Corporation"}, "dataVersion": "5.2"}