{
  "schema_version": "1.4.0",
  "id": "GHSA-vx8v-g3p3-88vg",
  "modified": "2022-04-19T18:01:53Z",
  "published": "2022-04-06T00:01:31Z",
  "aliases": [
    "CVE-2022-1235"
  ],
  "summary": "Weak password hash in LiveHelperChat",
  "details": "The secrethash, which the application relies for multiple security measures, can be brute-forced. The hash is quite small, with only 10 characters of only hexadecimal, making 16^10 possilibities ( 1.099.511.627.776 ). The SHA1 of the secret can be obtained via a captcha string and brute-forced offline with an GPU.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "remdex/livehelperchat"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.96"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1235"
    },
    {
      "type": "WEB",
      "url": "https://github.com/livehelperchat/livehelperchat/commit/6538d6df3d8a60fee254170b08dd76a161f7bfdc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/livehelperchat/livehelperchat"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/92f7b2d4-fa88-4c62-a2ee-721eebe01705"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-916"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-07T15:40:15Z",
    "nvd_published_at": "2022-04-05T07:15:00Z"
  }
}