GHSA-vx8v-g3p3-88vg

    Dashboard / Vulnerabilities / GHSA-vx8v-g3p3-88vg

    GHSA-vx8v-g3p3-88vg

    Published: 6 Apr 2022Last Modified: 6 Dec 2023

    Summary: Weak password hash in LiveHelperChat

    Details: The secrethash, which the application relies for multiple security measures, can be brute-forced. The hash is quite small, with only 10 characters of only hexadecimal, making 16^10 possilibities ( 1.099.511.627.776 ). The SHA1 of the secret can be obtained via a captcha string and brute-forced offline with an GPU.

    References: https://nvd.nist.gov/vuln/detail/CVE-2022-1235, https://github.com/livehelperchat/livehelperchat/commit/6538d6df3d8a60fee254170b08dd76a161f7bfdc, https://github.com/livehelperchat/livehelperchat, https://huntr.dev/bounties/92f7b2d4-fa88-4c62-a2ee-721eebe01705

    Affected packages

    Package

    Name: remdex/livehelperchat

    Purl: pkg:composer/remdex/livehelperchat

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -3.96

    Affected versions

    1.74

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-vx8v-g3p3-88vg | CVE-DB