PT-2022-13081 · Remdex · Livehelperchat

Published 2022-01-19 · Updated 2024-03-06 · CVE-2022-0266

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions remdex/livehelperchat versions prior to 3.92v

Description The issue is related to an authorization bypass through a user-controlled key. This allows unauthorized access, potentially leading to security breaches. The estimated number of affected devices and real-world incidents are not specified.

Recommendations For versions prior to 3.92v, update to version 3.92v or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application until the update is applied.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BIT-LIVEHELPERCHAT-2022-0266

CVE-2022-0266

GHSA-C7FM-JX59-WJF6

Affected Products

Livehelperchat

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0266.json · Exploit
• 🔥 https://huntr.dev/bounties/1ac267be-3af8-4774-89f2-77234d144d6b · Exploit
• https://github.com/livehelperchat/livehelperchat/commit/cc1122aed0d1ad9f05757eaea2ab9e6a924776bd · Patch
• https://osv.dev/vulnerability/GHSA-c7fm-jx59-wjf6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0266 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0266 · Security Note
• https://osv.dev/vulnerability/BIT-livehelperchat-2022-0266 · Vendor Advisory
• https://github.com/livehelperchat/livehelperchat · Note
• https://t.me/cibsecurity/35774 · Telegram Post