PT-2025-43902 · Chatwoot · Chatwoot

Fpatrik · Published 2025-10-27 · Updated 2025-10-27 · CVE-2025-12245

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions chatwoot versions prior to 4.7.0

Description A flaw exists in chatwoot that allows for origin validation errors. This issue is located within the initPostMessageCommunication function of the app/javascript/sdk/IFrameHelper.js file, part of the Widget component. Manipulation of the baseUrl argument can trigger this flaw. Remote exploitation is possible.

Recommendations Update to a version of chatwoot greater than 4.7.0.

Exploit

Fix

Insufficient Verification of Data Authenticity

Origin Validation Error

Weakness Enumeration

CWE-345

CWE-346

Related Identifiers

CVE-2025-12245

Affected Products

Chatwoot

References · 8

• 🔥 https://hckwr.com/blog/multiple-vulnerabilities-in-chatwoot · Exploit
• https://osv.dev/vulnerability/CVE-2025-12245 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12245 · Security Note
• https://vuldb.com/?submit.673800 · Note
• https://vuldb.com/?id.329916 · Note
• https://t.me/CVEtracker/35805 · Telegram Post
• https://vuldb.com/?ctiid.329916 · Note
• https://t.me/cveNotify/140411 · Telegram Post