GHSA-4xww-6h7v-29jg

User enumeration in livehelperchat

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-0083

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	remdex/livehelperchat	< 3.91	3.91

Details

As written in the advisory (Markdown source, shown as plain text).

livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information. There is an observable discrepancy between errors generated for users that exist and those that do not.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-0083 advisory
https://github.com/livehelperchat/livehelperchat/commit/fbed8728be59040a7218610e72f6eceb5f8bc152 web
https://github.com/livehelperchat/livehelperchat package
https://huntr.dev/bounties/4c477440-3b03-42eb-a6e2-a31b55090736 web