LiveActive security incident?Get immediate response
CVE Record

CVE-2023-45559: An issue in Tamaki_hamanoki Line v.13.6.1 allows attackers to send crafted notifications via leakage of the...

An issue in Tamaki_hamanoki Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.

HighCVSS 8.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2023-45559 is a high-severity token exposure issue in Tamaki_hamanoki Line v13.6.1. If the channel access token leaks, an attacker can send crafted notifications through that channel. Business risk is unauthorized messaging and possible exposure of channel-linked data; the provided sources do not identify a patch.

Executive priority

Treat as a high-priority secret exposure if the named software or token is present. Immediate token rotation is lower cost than investigating after unauthorized notification activity.

Technical view

The CVE describes leakage of a channel access token allowing unauthenticated network attackers to send crafted notifications. CVSS 3.1 is 8.2: network exploitable, low complexity, no privileges, no user interaction, high confidentiality impact, low integrity impact. The bundle lacks CWE, CPE, vendor, and fixed-version detail.

Likely exposure

Organizations are exposed if they use Tamaki_hamanoki Line v13.6.1 or inherited code/configurations containing the leaked channel access token. Exposure cannot be reliably scoped from CPE data because the provided affected metadata is incomplete.

Exploitation context

The provided CVE data does not show CISA KEV inclusion and does not cite active exploitation. The issue is still practical because possession of the token appears sufficient to send crafted notifications without user interaction.

Researcher notes

Evidence is sparse: one public report and CVE metadata, with no CPEs, CWE, or remediation version in the bundle. Avoid broad product assumptions; validate from deployed code, secret history, and token usage logs.

Mitigation direction

  • Rotate or revoke any exposed channel access token immediately.
  • Remove tokens from source code, public repositories, logs, and shared configuration.
  • Check project or vendor guidance for a fixed release or official workaround.
  • Restrict token permissions where the platform supports scoped access.
  • Monitor notification activity for unauthorized messages after rotation.

Validation and detection

  • Confirm whether Tamaki_hamanoki Line v13.6.1 is deployed or forked internally.
  • Search approved code and configuration stores for channel access tokens.
  • Review repository history for previously exposed secrets.
  • Check notification logs for unexpected or crafted messages.
  • Verify new tokens are stored only in approved secret management.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2023-45559 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.2 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
2Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: yesTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.2CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N3.94.2CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

8.2High
CVSS 3.1 vector shape for CVE-2023-45559Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.