CVE-2025-56139

{
  "id": "CVE-2025-56139",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-03T20:15:34.680",
  "lastModified": "2026-11-07T18:10:00.200",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, description) when a user replaces the original URL in a post or comment before publishing. As a result, the stale preview remains visible while the clickable link points to a different URL, which can be malicious. This UI misrepresentation enables attackers to deceive users by displaying trusted previews for harmful links, facilitating phishing attacks and user confusion."
    },
    {
      "lang": "es",
      "value": "La aplicación móvil de LinkedIn para Android versión 4.1.1087.2 no actualiza los metadatos de la vista previa del enlace (imagen, título, descripción) cuando un usuario reemplaza la URL original en una publicación o comentario antes de publicar. Como resultado, la vista previa obsoleta permanece visible mientras que el enlace clicable apunta a una URL diferente, que puede ser maliciosa. Esta tergiversación de la interfaz de usuario permite a los atacantes engañar a los usuarios mostrando vistas previas de confianza para enlaces dañinos, facilitando ataques de phishing y confusión del usuario."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-03T20:14:55.663389Z",
          "id": "CVE-2025-56139",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-449"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:linkedin:linkedin:4.1.1087.2:*:*:*:*:android:*:*",
              "matchCriteriaId": "7841A213-4A45-4E6C-88F8-64FF81F0AF4D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://hdhrmi.blogspot.com/2025/07/aiman-al-hadhrami-linkedin-vulnerability.html",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://hdhrmi.blogspot.com/2025/09/link-preview-mismatch-cve-2025-56139.html",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}