CVE-2022-1176 Loose comparison causes IDOR on multiple endpoints in livehelperchat/livehelperchat
Attackers can bypass authentication checks on multiple endpoints due to loose comparison, allowing unauthorized access to data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-1176?
CVE-2022-1176 is a high-severity authentication bypass vulnerability in livehelperchat/livehelperchat, published on 31 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96.
Weakness: CWE-843
Which versions are affected by CVE-2022-1176?
3 open source packages ship an affected version, including remdex/livehelperchat and livehelperchat. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
remdex/livehelperchat Packagist | All versions | 3.96 |
remdex/livehelperchat Packagist | All versions | 3.96 |
livehelperchat Bitnami | All versions | 3.96.0 |
Products include Livehelperchat Live Helper Chat.
How do I fix CVE-2022-1176?
Upgrade remdex/livehelperchat to 3.96 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-1176 being exploited?
There is no known exploitation of CVE-2022-1176 in the wild and no public exploit code.
Other vulnerabilities in livehelperchat/livehelperchat
- CVE-2024-27516 livehelperchat Server-Side Template Injection
- CVE-2022-0935 Host Header injection in password Reset in livehelperchat/livehelperchat
- CVE-2022-1234 XSS in livehelperchat in livehelperchat/livehelperchat
- CVE-2022-1191 SSRF on index.php/cobrowse/proxycss/ in livehelperchat/livehelperchat
- CVE-2022-1213 SSRF filter bypass port 80, 433 in livehelperchat/livehelperchat
Sources
Also known as BIT-livehelperchat-2022-1176, GHSA-5cmw-fhq9-8fhh.