CVE-2021-3742

Published: Nov 15, 2024Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0. The vulnerability allows an attacker to upload an SVG file containing a malicious SSRF payload. When the SVG file is used as an avatar and opened in a new tab, it can trigger the SSRF, potentially leading to host redirection.

Affected (1)

Products: Chatwoot: Chatwoot

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Chatwoot Chatwoot	Before 2.5.0

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

https://github.com/chatwoot/chatwoot/commit/6fdd4a29969be8423f31890b807d27d13627c50c

Source: security@huntr.dev

Product

https://huntr.com/bounties/1625472546121-chatwoot/chatwoot

Source: security@huntr.dev

Broken Link

Timeline

No history available yet.