Lucene search

[email protected]CVE-2023-51371

HistoryDec 29, 2023 - 11:15 a.m.

CVE-2023-51371

2023-12-2911:15:09

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-51371

web page generation

cross-site scripting

bit assist chat widget

vulnerability

stored xss

whatsapp chat

facebook messenger chat

telegram chat bubble

line messenger

live chat support

wechat

sms

call button

customer support button

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

5.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.1%

JSON

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Bit Assist Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget allows Stored XSS.This issue affects Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget: from n/a through 1.1.9.

Affected configurations

Vulners

NVD

Node

bit_assistchat_widget\Match_whatsapp_chat\,_facebook_messenger_chat\,_telegram_chat_bubble\,_line_messenger\,_live_chat_support_chat_button\,_wechat\,_sms\,_call_button\,_customer_support_button_with_floating_chat_widget

CPENameOperatorVersion
bitapps:bit_assistbitapps bit assistle1.1.9

CPE	Name	Operator	Version
bitapps:bit_assist	bitapps bit assist	le	1.1.9

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "bit-assist",
    "product": "Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget",
    "vendor": "Bit Assist",
    "versions": [
      {
        "changes": [
          {
            "at": "1.2",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.1.9",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/bit-assist/wordpress-chat-button-plugin-1-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve