CVE-2022-3741 Information

Description

Impact varies for each individual vulnerability in the application. For generation of accounts it may be possible depending on the amount of system resources available to create a DoS event in the server. These accounts still need to be activated; however it is possible to identify the output Status Code to separate accounts that are generated and waiting for email verification. \n\nFor the sign in directories it is possible to brute force login attempts to either login portal which could lead to account compromise.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Reference

https://huntr.dev/bounties/46f6e07e-f438-4540-938a-510047f987d0 https://github.com/chatwoot/chatwoot/commit/9525d4f0346a2fdac13a0253f9180d20104a72d3

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

9.8