CVE-2024-0640
Stored XSS in chatwoot/chatwoot
- State
- Published
- Severity
- 5.6 Medium
- Published
- Mar 20, 2025
- Updated
- Mar 20, 2025
- Reserved
- Jan 17, 2024
Description
A stored cross-site scripting (XSS) vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1. This vulnerability allows an admin user to inject malicious JavaScript code via the dashboard app settings, which can then be executed by another admin user when they access the affected dashboard app. The issue is fixed in version 3.5.2.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 5.6 Medium | CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N | @huntr_ai |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
chatwoot/chatwootchatwoot |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.