CVE-2021-3740mediumCWE-384

CVE-2021-3740: falha de média gravidade em chatwoot/chatwoot

Session Fixation in chatwoot/chatwoot

Publicada em

Seguir esta CVE+ Monitorar chatwoot/chatwoot

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.8epss 0.2%
A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions on other devices when a user changes their password, allowing old sessions to persist. This can lead to unauthorized access if an attacker has obtained a session token.
CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
chatwoot · chatwoot/chatwoot
CVEs relacionadas — chatwoot/chatwoot

No mesmo produto, das mais perigosas para as menos.

CVE-2022-1022HIGHCross-site Scripting (XSS) - Stored in chatwoot/chatwootEPSS 4.5%CVE-2022-3741CRITICALImproper Restriction of Excessive Authentication Attempts in chatwoot/chatwootEPSS 1.2%CVE-2021-3649HIGHInefficient Regular Expression Complexity in chatwoot/chatwootEPSS 1.2%CVE-2021-3813MEDIUMImproper Privilege Management in chatwoot/chatwootEPSS 1.1%CVE-2022-0542HIGHCross-site Scripting (XSS) - DOM in chatwoot/chatwootEPSS 1.0%CVE-2022-0526HIGHCross-site Scripting (XSS) - Stored in chatwoot/chatwootEPSS 0.9%