Stored Cross-Site Scripting Vulnerability in Chatwoot by Chatwoot

CVE-2024-0640

What is CVE-2024-0640?

A stored cross-site scripting vulnerability in Chatwoot versions 3.0.0 through 3.5.1 allows an admin user to inject harmful JavaScript code via the dashboard app settings. This malicious script can subsequently be executed by any other admin who visits the affected settings. The issue has been resolved in version 3.5.2, emphasizing the importance of keeping applications up to date to protect against such vulnerabilities.

References