Detections
Analytics

Intercom Chatbot Misconfiguration

medium Web App Scanning Plugin ID 115001

Language:

Synopsis

Intercom Chatbot Misconfiguration

Description

Intercom is a solution to build & deploy AI customer experiences. If the identity verification is not enabled, an attacker can impersonate an other user and access to the previous conversations and data. This detection is included in the AI and LLM category.

Solution

Enable identity verification in Intercom settings.

See Also

https://medium.com/@hellother18/uncovering-a-vulnerability-in-intercom-widget-chat-configuration-e5633d06df60

https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile

Plugin Details

Severity: Medium

ID: 115001

Type: remote

Published: 10/7/2025

Updated: 10/7/2025

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: Low

Score: 2.9

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: Tenable

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS Score Source: Tenable

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: Tenable

Vulnerability Information

CPE: cpe:2.3:a:fin.ai:intercom:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Reference Information