MEDIUM
Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot
Published Apr 17, 2023
6.1
MEDIUMCVSS 3.1
EPSS 0.37%
Description
Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0.
Affected products
-
- Version unspecifiedStatusaffectedConstraints<2.14.0
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Chatwoot | Chatwoot/chatwoot | n/a |
|
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (3)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-33630 Advisory
- https://github.com/chatwoot/chatwoot/commit/a06a5a574ad908b0ef2db7b47d05c3774eeb493d Patch
- https://huntr.dev/bounties/fd5999fd-b1fd-44b4-ae2e-8f95b5c3d1b6 Permissions RequiredThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-33630 | Advisory | |
| https://github.com/chatwoot/chatwoot/commit/a06a5a574ad908b0ef2db7b47d05c3774eeb493d | Patch | |
| https://huntr.dev/bounties/fd5999fd-b1fd-44b4-ae2e-8f95b5c3d1b6 | Permissions RequiredThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner @huntrdev
Published Apr 17, 2023
Updated Feb 5, 2025
Reserved Apr 17, 2023
Link CVE-2023-2109
CISA Vulnrichment
Updated Feb 5, 2025
ENISA EUVD
EUVD-2023-33630 Assigner @huntrdev
Published Apr 17, 2023
Updated Feb 5, 2025
Exploited since n/a
Link EUVD-2023-33630