GHSA-w4hp-pcp8-qhf3MediumCVSS 5.4

Cross-site Scripting in livehelperchat

Published
January 28, 2022
Last Modified
February 3, 2023

🔗 CVE IDs covered (1)

📋 Description

Stored XSS is found in Settings>Live help configuration>Departments->Departments groups->edit When a user creates a new webhook under the NAME field and puts a payload {{constructor.constructor('alert(1)')()}}, the input gets stored, at user edit groupname , the payload gets executed.

🎯 Affected products1

  • composer/remdex/livehelperchat:< 3.93

🔗 References (4)