CVE-2022-3741
Critical
Description
Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output Status Code to separate accounts that are generated and waiting for email verification. \n\nFor the sign in directories, it is possible to brute force login attempts to either login portal, which could lead to account compromise.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Chatwoot
PublishedOct 28, 2022
First seenOct 28, 2022
Weakness typeCWE-307CWE-307
How to fix
Update
- chatwoot chatwoot2.10.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| chatwoot chatwoot | v < 2.10.0 | 2.10.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.