GHSA-8wcc-f2vq-h4gx

ghsaUSosv

Cross-site Scripting in livehelperchat

view advisory published 2022-01-28Licence: CC-BY-4.0

Stored XSS is found in Settings>Live help configuration>Personal Theme>static content. Under the NAME field put a payload {{constructor.constructor('alert(1)')()}} while creating content, and you will see that the input gets stored, and every time the user visits, the payload gets executed.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-0370US	medium5.4	0.77% (55th)	—	2022-01-27
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.

references

External citations — patches, advisories, analysis.

https://github.com/livehelperchat/livehelperchatPACKAGE
https://github.com/livehelperchat/livehelperchat/commit/9f5bc33c943349bd765b991db0b7f6b6ef05cfdbWEB
https://huntr.dev/bounties/fbe4b376-57ce-42cd-a9a9-049c4099b3caWEB
https://nvd.nist.gov/vuln/detail/CVE-2022-0370ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan