CVE-2021-3742CWE-918

Server-Side Request Forgery (SSRF) in chatwoot/chatwoot

High · published November 15, 2024

CVSS v3.0
7.9
EPSS
0%
Percentile
30.8
In the wild
Unconfirmed
What it is

A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0. The vulnerability allows an attacker to upload an SVG file containing a malicious SSRF payload. When the SVG file is used as an avatar and opened in a new tab, it can trigger the SSRF, potentially leading to host redirection.

The record
Technical detail
CVSS v3.0
7.9 · HIGH
Vector
CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00381 · 30.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2024-11-15T10:51Z
EPSS history
Timeline
  • 15 NOV 10:51Z
    Server-Side Request Forgery (SSRF) in chatwoot/chatwoot
    cvelistv5