CVE-2020-37106: CSRF in Business Live Chat Software

The primary impact of CVE-2020-37106 is the unauthorized elevation of user privileges. An attacker can craft a malicious HTML form that, when submitted, triggers a POST request to the user creation endpoint. By including administrative access parameters within this request, the attacker can effectively change a user's role to an administrator, bypassing standard authentication mechanisms. This could lead to complete control over the Business Live Chat Software instance, including access to sensitive data, modification of chat logs, and potentially even compromise of the underlying server. The blast radius extends to all users of the vulnerable software, as any authenticated user could be targeted to have their role changed.

1. Reserved2026-02-01
2. Published2026-02-06
3. Modified2026-02-17
4. EPSS updated2026-03-23

The recommended mitigation for CVE-2020-37106 is to upgrade to a patched version of Business Live Chat Software as soon as it becomes available. In the interim, implement Web Application Firewall (WAF) rules to filter out suspicious POST requests targeting the user creation endpoint. Specifically, look for requests containing administrative access parameters without proper authentication. Additionally, strengthen input validation on the user creation endpoint to prevent malicious data from being processed. Consider implementing CSRF tokens to further protect against this type of attack. After upgrade, confirm the vulnerability is resolved by attempting to modify user roles via a crafted HTML form.