CVE-2022-3741

Katalog CVE

CVSS 9.8 · Critical EPSS 0,99%

Kerentanan Improper Restriction of Excessive Authentication Attempts pada chatwoot. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output Status Code to separate accounts that are generated and waiting for email verification. \n\nFor the sign in directories, it is possible to brute force login attempts to either login portal, which could lead to account compromise.

Rincian

Terbit di NVD

28 Oktober 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-307: Improper Restriction of Excessive Authentication Attempts

EPSS (30 hari)

0,99% peluang dieksploitasi; lebih tinggi dari 61,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/chatwoot/chatwoot/commit/9525d4f0346a2fdac13a0253f9180d20104a72d3 patch · advisory pihak ketiga
• https://huntr.dev/bounties/46f6e07e-f438-4540-938a-510047f987d0 exploit · issue tracking · patch · advisory pihak ketiga