GHSA-6jmh-9gqm-5xrx

ghsaUSosv

Cross-Site Request Forgery (CSRF) in livehelperchat

view advisory published 2022-01-26Licence: CC-BY-4.0

A CSRF issue is found in the audit configuration under settings. It was found that no CSRF token validation is getting done on the server-side. If we remove the CSRF token and keep the CSRF token field empty, the action is getting performed.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-0226US	medium4.3	0.43% (38th)	—	2022-01-14
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

references

External citations — patches, advisories, analysis.

https://github.com/livehelperchat/livehelperchatPACKAGE
https://github.com/livehelperchat/livehelperchat/commit/f59ffb02984c0ce2fbb19ac39365066507de9370WEB
https://huntr.dev/bounties/635d0abf-7680-47f6-a277-d9a91471c73fWEB
https://nvd.nist.gov/vuln/detail/CVE-2022-0226ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan