CVE-2021-3740

Published: Nov 15, 2024Modified: Jun 17, 2026

6.8

Vector

CVSS:3.0/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Exploitability: 0.9 / Impact: 5.9

Source: security@huntr.dev (Secondary)

Description

A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions on other devices when a user changes their password, allowing old sessions to persist. This can lead to unauthorized access if an attacker has obtained a session token.

Affected (1)

Products: Chatwoot: Chatwoot

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Chatwoot Chatwoot	Before 2.4.0

Related CWEs

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (2)

https://github.com/chatwoot/chatwoot/commit/6fdd4a29969be8423f31890b807d27d13627c50c

Source: security@huntr.dev

Patch

https://huntr.com/bounties/1625470476437-chatwoot/chatwoot

Source: security@huntr.dev

Broken Link

Timeline

No history available yet.