CVE-2024-0640
CVSS 3.0 Score 5.6 of 10 (medium)
Details
Published Mar 20, 2025
CWE ID 79
Summary
CVE-2024-0640 is a stored cross-site scripting (XSS) vulnerability affecting Chatwoot versions 3.0.0 to 3.5.1. This issue permits an admin user to inject malicious JavaScript code into the dashboard app settings. Consequentially, another admin user who accesses the affected dashboard app will unwittingly execute the malicious code. This security flaw has been rectified in Chatwoot version 3.5.2.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.