CVE-2024-0640

MEDIUM EPSS 16.0%
Published Mar 20, 20251y ago · Modified Jun 17, 20262w ago
4.8 CVSS 3.1
Medium
Find Similar
Published Mar 20, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

A stored cross-site scripting (XSS) vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1. This vulnerability allows an admin user to inject malicious JavaScript code via the dashboard app settings, which can then be executed by another admin user when they access the affected dashboard app. The issue is fixed in version 3.5.2.

CVSS Details

Base Score
4.8
Exploitability
1.7
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
16.0% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
chatwootchatwoot* <3.5.2

References 2

  • github.com https://github.com/chatwoot/chatwoot/commit/e39c14460b860d5e3d23d989dd6af48404ad1bb4
    Patch
  • huntr.com https://huntr.com/bounties/08b3bebf-ce3c-4416-b75e-1927ba61de85
    ExploitIssue TrackingPatchThird Party Advisory

Remediation

  • github.com https://github.com/chatwoot/chatwoot/commit/e39c14460b860d5e3d23d989dd6af48404ad1bb4
    Patch
  • huntr.com https://huntr.com/bounties/08b3bebf-ce3c-4416-b75e-1927ba61de85
    ExploitIssue TrackingPatchThird Party Advisory