CVE Vulnerability

CVE-2022-0642

The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript.

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

5.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://wpscan.com/vulnerability/099cf9b4-0b3a-43c6-8ca9-7c2d50f86425 Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:jivochat:jivochat:*:*:*:*:*:wordpress:*:*
Information

Published : 2022-05-30 09:15

Updated : 2022-06-13 02:20

NVD link : CVE-2022-0642

Mitre link : CVE-2022-0642

Products Affected
No products.
CWE
CWE-352