CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Smartsupp Smartsupp – live chat, chatbots, AI and lead generation smartsupp-live-chat allows Cross Site Request Forgery.This issue affects Smartsupp – live chat, chatbots, AI and lead generation: from n/a through <= 3.6.
Explanation of Vulnerability in Simple Terms
Smartsupp live chat versions 3.6 and earlier are vulnerable to cross-site request forgery (CSRF). An attacker can craft a malicious webpage that, when visited by a logged-in Smartsupp user, performs unwanted actions on their account without their knowledge. The vulnerability requires the victim to visit the attacker's page while authenticated to Smartsupp.
What an attacker can do
Perform actions on a Smartsupp user's account without their consent by tricking them into visiting a malicious webpage.
Potential impact on your site
If you use Smartsupp, an attacker could modify your chat settings, messages, or account configuration without your permission.
Conditions required to exploit
Victim must be logged into Smartsupp and visit an attacker-controlled webpage.
Key dates
External resources
Related vulnerabilities
