Vulnerability Details : CVE-2022-3741
Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output Status Code to separate accounts that are generated and waiting for email verification. \n\nFor the sign in directories, it is possible to brute force login attempts to either login portal, which could lead to account compromise.
Vulnerability category: Denial of service
Products affected by CVE-2022-3741
- cpe:2.3:a:chatwoot:chatwoot:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-3741
0.19%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 57 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-3741
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.4
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
3.9
|
5.5
|
huntr.dev | |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2022-3741
-
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.Assigned by:
- nvd@nist.gov (Primary)
- security@huntr.dev (Secondary)
References for CVE-2022-3741
-
https://huntr.dev/bounties/46f6e07e-f438-4540-938a-510047f987d0
Chatwoot's Misconfigured Rack_Attack.rb Does Not Appropriately Protect Against Brute Force Attacks vulnerability found in chatwootExploit;Issue Tracking;Patch;Third Party Advisory
-
https://github.com/chatwoot/chatwoot/commit/9525d4f0346a2fdac13a0253f9180d20104a72d3
chore: Improve rack-attack configuration (#5389) · chatwoot/chatwoot@9525d4f · GitHubPatch;Third Party Advisory
Jump to