PT-2024-10979 · Chatwoot · Chatwoot

Name of the Vulnerable Software and Affected Versions: chatwoot/chatwoot versions prior to 2.4.0 Description: A Session Fixation issue exists, where the application does not invalidate existing sessions on other devices when a user changes their password, allowing old sessions to persist. This ca...

Chatwoot 授权问题漏洞

Chatwoot is a Chatwoot open source application. Customer Engagement Suite, an open source alternative to Intercom, Zendesk, Salesforce Service Cloud, and more. An authorization issue vulnerability exists in versions prior to Chatwoot 2.4.0 that stems from the presence of a session fixation...

chatwoot Cross-Site Scripting Vulnerability (CNVD-2023-29696)

chatwoot is an application. Customer Engagement Suite, an open source alternative to intercom, Zendesk, Salesforce Service Cloud, etc. A cross-site scripting vulnerability exists in chatwoot versions prior to 2.14.0. The vulnerability stems from the application's lack of effective filtering and...

CVE-2023-2109

Cross-site Scripting XSS - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0...

PT-2023-17883 · Chatwoot · Chatwoot

Name of the Vulnerable Software and Affected Versions: chatwoot/chatwoot versions prior to 2.14.0 Description: The issue is related to Cross-site Scripting XSS - DOM, which allows an attacker to inject malicious scripts into a website, potentially leading to unauthorized access or control...

CVE-2023-2109 Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot

Cross-site Scripting XSS - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0...

chatwoot 跨站脚本漏洞

chatwoot is an application. Customer Engagement Suite, an open source alternative to intercom, Zendesk, Salesforce Service Cloud, etc. A cross-site scripting vulnerability exists in chatwoot versions prior to 2.14.0. The vulnerability stems from the application's lack of effective filtering and...

CVE-2023-2109

CVE-2023-2109 describes a DOM-based XSS in the chatwoot/chatwoot project prior to version 2.14.0. Multiple connected sources corroborate the issue as a cross-site scripting vulnerability in the Chatwoot dashboard/chat UI, arising from unsanitized user-supplied data being inserted into the DOM (fo...

CVE-2023-2109 Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot

Cross-site Scripting XSS - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0...

XSS via postMessage to deface any website and account takeover

Description Hey Chatwoot team, while looking for vulnerabilities I found a critical XSS which allow us to XSS/Deface any website which uses the chat, this can be automated to attack thousands of websites Vulnerable Code Inside this function...

CVE-2022-3741 Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot

Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output...

chatwoot 安全漏洞

chatwoot is a software application. Customer Engagement Suite, an open source alternative to Intercom, Zendesk, Salesforce Service Cloud, and more. A security vulnerability exists in chatwoot that stems from for account generation, depending on the amount of available system resources, a DoS even...

CVE-2022-3741 Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot

Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output...

CVE-2022-2901

Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8...

CVE-2022-2901

Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8...

Authorization

Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8...

CVE-2022-2901

CVE-2022-2901 affects chatwoot/chatwoot prior to 2.8. Root cause is improper authorization. Documented impact is high-severity, with access to unauthorized operations implied but not detailed in the sources. Remediation: upgrade to version 2.8 or later (fix referenced in multiple sources). Additi...

CVE-2022-2901 Improper Authorization in chatwoot/chatwoot

Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8...

CVE-2022-2901 Improper Authorization in chatwoot/chatwoot

Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8...

PT-2022-19364 · Chatwoot · Chatwoot

Name of the Vulnerable Software and Affected Versions: chatwoot/chatwoot versions prior to 2.8 Description: The issue is related to improper authorization in the GitHub repository chatwoot/chatwoot. Recommendations: For versions prior to 2.8, update to version 2.8 or later to resolve the issue...