CVE-2021-3741

A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerability occurs when a user uploads an SVG file containing a malicious XSS payload in the profile settings. When the avatar is opened in a new page, the custom JavaScript code is executed, leading to potential security risks.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/chatwoot/chatwoot/commit/6fdd4a29969be8423f31890b807d27d13627c50c	Product
https://huntr.com/bounties/1625474692857-chatwoot/chatwoot	Broken Link

Configurations

Configuration 1 (hide)

cpe:2.3:a:chatwoot:chatwoot:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-11-15 11:15

Updated : 2024-11-19 17:07

NVD link : CVE-2021-3741

Mitre link : CVE-2021-3741

CVE.ORG link : CVE-2021-3741

JSON object : View

Products Affected

chatwoot

chatwoot

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2021-3741", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.2}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2024-11-15T11:15:05.327", "references": [{"url": "https://github.com/chatwoot/chatwoot/commit/6fdd4a29969be8423f31890b807d27d13627c50c", "tags": ["Product"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/1625474692857-chatwoot/chatwoot", "tags": ["Broken Link"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerability occurs when a user uploads an SVG file containing a malicious XSS payload in the profile settings. When the avatar is opened in a new page, the custom JavaScript code is executed, leading to potential security risks."}, {"lang": "es", "value": "Se descubri\u00f3 una vulnerabilidad de cross-site scripting (XSS) almacenado en chatwoot/chatwoot, que afecta a todas las versiones anteriores a la 2.6. La vulnerabilidad se produce cuando un usuario carga un archivo SVG que contiene un payload XSS malicioso en la configuraci\u00f3n del perfil. Cuando se abre el avatar en una p\u00e1gina nueva, se ejecuta el c\u00f3digo JavaScript personalizado, lo que genera posibles riesgos de seguridad."}], "lastModified": "2024-11-19T17:07:38.267", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:chatwoot:chatwoot:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63976EA8-9880-4802-8B08-9E2C679FF9F9", "versionEndExcluding": "2.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}