PT-2024-10979 · Chatwoot · Chatwoot

Published 2024-11-15 · Updated 2025-07-10 · CVE-2021-3740

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions chatwoot/chatwoot versions prior to 2.4.0

Description A Session Fixation issue exists, where the application does not invalidate existing sessions on other devices when a user changes their password, allowing old sessions to persist. This can lead to unauthorized access if an attacker has obtained a session token.

Recommendations For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue. As a temporary workaround, consider invalidating existing sessions on other devices when a user changes their password to minimize the risk of exploitation.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2021-3740

Affected Products

Chatwoot

References · 9

• https://github.com/chatwoot/chatwoot/commit/6fdd4a29969be8423f31890b807d27d13627c50c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-3740 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3740 · Vendor Advisory
• https://t.me/cvenotify/128378 · Telegram Post
• https://twitter.com/CVEnew/status/1857381720452153552 · Twitter Post
• https://huntr.com/bounties/1625470476437-chatwoot/chatwoot · Note
• https://twitter.com/transilienceai/status/1857654671914983827 · Twitter Post
• https://t.me/cvenotify/101799 · Telegram Post
• https://twitter.com/transilienceai/status/1857654666898583900 · Twitter Post