WP Live Chat Support allows adding to the website free chat through which employees can provide support and assistance to resource visitors.
Experts from Alert Logic found that plugin versions 8.0.32 and below allow an unauthenticated attacker to gain access to REST API endpoints, which should not be available under normal circumstances. The vulnerability received the identifier CVE-2019-12498. Due to exploitation of the bug, an attacker can not only steal all the logs of already completed chats, but also interfere with still active chat sessions.
The researchers say that with the help of a bug, an attacker can insert his own messages into active chats, edit them, and carry out DoS attacks, due to which chat sessions will be urgently terminated.
“Note that we had not seen attackers attempt this specific bypass in our customer data, and do not believe that it was being actively exploited”, — report researchers.
The primary resolution of this vulnerability is to update the plugin to the latest version. If this cannot be achieved, then mitigation options may include:
Virtual patching using a WAF to filter traffic destined for the WP Live Chat Support REST endpoint
Interestingly, in the past month, Sucuri’s specialists discovered another dangerous problem in WP Live Chat Support -XSS bug, which allowed automating attacks on vulnerable sites and introducing malicious code without authentication. Criminals quickly began to exploit this vulnerability.
Concluding, according to ZScaler ThreatLabZ, attackers injected malicious JavaScript on vulnerable sites, which organized forced redirects and was responsible for arrival of pop-up windows and fake subscriptions.
Source: https://blog.alertlogic.com
About Denctably.co.in Denctably.co.in pop-ups can not expose out of the blue. If you have actually…
About Linortuf.xyz Linortuf.xyz pop-ups can not expose out of the blue. If you have actually…
About Previsionimeteo.info Previsionimeteo.info pop-ups can not open out of nowhere. If you have clicked some…
About Libpubebb.live Libpubebb.live pop-ups can not expose out of the blue. If you have clicked…
About Protecttoday.space Protecttoday.space pop-ups can not open out of nowhere. If you have clicked some…
About Buyited24.club Buyited24.club pop-ups can not introduce out of the blue. If you have actually…