CVE-2025-51400
BaseFortify
Publication date: 2025-07-21
Last updated on: 2025-08-07
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| livehelperchat | live_helper_chat | to 4.61 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stored Cross-Site Scripting (XSS) flaw in the Personal Canned Messages feature of Live Helper Chat versions up to 4.61. It occurs because the application does not properly sanitize input, allowing attackers to inject malicious JavaScript code. When an admin or operator views or uses these crafted messages, the malicious script executes in their browser, potentially compromising their session or enabling unauthorized actions. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow attackers to execute arbitrary scripts in the context of an admin or operator's browser session. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or other malicious activities that compromise the security and integrity of the Live Helper Chat environment. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by logging in as an operator or admin user to the Live Helper Chat application, navigating to the Personal Canned Messages section, and checking for any messages containing suspicious payloads such as `"><img src=\"x\" onerror=\"prompt(1);\">`. There are no specific network commands provided, but manual inspection of the canned messages for injected scripts is recommended. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, update Live Helper Chat to version 4.61 or later where the issue has been patched. Additionally, review and sanitize existing Personal Canned Messages to remove any malicious scripts or payloads. Limit operator and admin access to trusted users until the patch is applied. [1]