CVE-2024-0640

Stored XSS in chatwoot/chatwoot

Description

A stored cross-site scripting (XSS) vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1. This vulnerability allows an admin user to inject malicious JavaScript code via the dashboard app settings, which can then be executed by another admin user when they access the affected dashboard app. The issue is fixed in version 3.5.2.

Category

5.6
CVSS
Severity: Medium
CVSS 3.0 •
EPSS 0.02%
Affected: chatwoot chatwoot/chatwoot
Published at:
Updated at:

References

Link Tags
https://huntr.com/bounties/08b3bebf-ce3c-4416-b75e-1927ba61de85
https://github.com/chatwoot/chatwoot/commit/e39c14460b860d5e3d23d989dd6af48404ad1bb4

Frequently Asked Questions

What is the severity of CVE-2024-0640?
CVE-2024-0640 has been scored as a medium severity vulnerability.
How to fix CVE-2024-0640?
To fix CVE-2024-0640, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-0640 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-0640 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-0640?
CVE-2024-0640 affects chatwoot chatwoot/chatwoot.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.