GitHub Advisoryadvisory · Packagist

GHSA-6jmh-9gqm-5xrx Cross-Site Request Forgery (CSRF) in livehelperchat

MEDIUM Published 2022-01-26 Modified 2022-01-24 Official page ↗
Aliases
CVE-2022-0226
Ecosystem
Packagist
Packages
remdex/livehelperchat
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-352
Reviewed
2022-01-24

Affected packages

• Packagist remdex/livehelperchat: < 3.92 → fixed in 3.92

Description

A CSRF issue is found in the audit configuration under settings. It was found that no CSRF token validation is getting done on the server-side. If we remove the CSRF token and keep the CSRF token field empty, the action is getting performed.

Related

Alias · CVE (1)

  • CVE-2022-0226 livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References