GHSA-hhr9-7xvh-8xgc

Server side request forgery in LiveHelperChat

Source: GitHub Advisory Database (reviewed) High CVE-2022-1213

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	remdex/livehelperchat	< 3.67	3.67

Details

As written in the advisory (Markdown source, shown as plain text).

SSRF filter bypass port 80, 433 in LiveHelperChat prior to v3.67. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-1213 advisory
https://github.com/LiveHelperChat/livehelperchat/issues/1752 web
https://github.com/livehelperchat/livehelperchat/commit/abc9599ee7aded466ca216741dcaea533c908111 web
https://github.com/livehelperchat/livehelperchat package
https://huntr.dev/bounties/084387f6-5b9c-4017-baa2-5fcf65b051e1 web