CVE-2024-0640: Stored XSS in chatwoot/chatwoot
Published Mar 20, 2025
·Updated
A stored cross-site scripting (XSS) vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1. This vulnerability allows an admin user to inject malicious JavaScript code via the dashboard app settings, which can then be executed by another admin user when they access the affected dashboard app. The issue is fixed in version 3.5.2.
Affected Software
2 affected components
chatwoot Chatwoot>=3.0.0<=3.5.1
chatwoot Chatwoot<3.5.2
Remediation
Event History
Mar 20, 2025
CVE Published
via MITRE·10:10 AM
Data Sourced
via MITRE·10:10 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-0640?
CVE-2024-0640 is classified as a medium severity stored cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2024-0640?
To fix CVE-2024-0640, upgrade Chatwoot to version 3.5.2 or later.
3
Who is affected by CVE-2024-0640?
CVE-2024-0640 affects Chatwoot versions 3.0.0 to 3.5.1.
4
What type of vulnerability is CVE-2024-0640?
CVE-2024-0640 is a stored cross-site scripting (XSS) vulnerability.
5
What can an attacker do with CVE-2024-0640?
An attacker can inject malicious JavaScript code that may be executed by other admin users in the Chatwoot dashboard.