Read the docs
TI-2024-01060 Aliases CVE-2024-1143GHSA-34q3-p352-c7q8

Cross-site scripting in LINE Corporation Central Dogma

Priority MEDIUM 41CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00491 42nd percentileScored 2026-11-07
Fix Fixed Central Dogma (LINE Corporation): 0.64.1com.linecorp.centraldogma:centraldogma-server (Maven): 0.64.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LINE CorporationCentral Dogma0.63.3 to before 0.64.10.64.1Patch availableCNA
—com.linecorp.centraldogma:centraldogma-server (Maven)before 0.64.10.64.1Patch availableGHSA-34q3-p352-c7q8
  • Central Dogma VendorLINE Corporation Affected 0.63.3 to before 0.64.1 Fixed in 0.64.1 Patch available CNA
  • com.linecorp.centraldogma:centraldogma-server (Maven) Vendor— Affected before 0.64.1 Fixed in 0.64.1 Patch available GHSA-34q3-p352-c7q8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linecorp:central_dogma:*:*:*:*:*:*:*:*before 0.64.1VulnerableLinecorp
  • cpe:2.3:a:linecorp:central_dogma:*:*:*:*:*:*:*:* Versions before 0.64.1 Vulnerable ·Linecorp

Remediation

  • Fix · CNA Central Dogma (LINE Corporation) Fixed in 0.64.1
  • Fix · GHSA-34q3-p352-c7q8 com.linecorp.centraldogma:centraldogma-server (Maven) Fixed in 0.64.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-1143
  2. 2026-10-03 Alias added: GHSA-34q3-p352-c7q8

References

Advisory 2

Other 2

  • TI-2024-01613 Improper authentication in LINE Corporation Armeria CVSS 3.1CRITICAL 9.1
  • TI-2023-05112 Improper certificate validation in LINE client for iOS CVSS 3.1CRITICAL 9.8
  • TI-2023-19873 Paths contain matrix variables bypass decorators CVSS 3.1HIGH 7.5
  • TI-2022-19973 LINE client for iOS before 12.17.0 might be crashed by sharing an invalid shared key of e2ee in group chat. CVSS 3.1HIGH 7.5
  • TI-2021-15992 Missing authorization in LINE Corporation Central Dogma CVSS 3.1HIGH 8.8
  • TI-2019-04299 Integer overflow in LINE CVSS 3.1HIGH 7.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences