CVE-2025-14022
BaseFortify
Publication date: 2025-12-15
Last updated on: 2025-12-18
Assigner: LINE Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linecorp | line | to 15.4.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the LINE client for iOS versions prior to 15.4. It is caused by improper SSL/TLS certificate validation within an integrated financial SDK. The SDK disrupts the application's network processing, disabling server certificate verification for a significant portion of network traffic. This flaw allows a network-adjacent attacker to perform man-in-the-middle attacks by intercepting or modifying encrypted communications.
How can this vulnerability impact me? :
The vulnerability can allow an attacker who is near the network to intercept or alter encrypted communications between the LINE client and its servers. This could lead to exposure of sensitive information, unauthorized data modification, and potential compromise of user privacy and security.