Chatwoot CVE-2022-1021

MEDIUM

Insecure Storage of Sensitive Information (CWE-922)

2022-08-19 security@huntr.dev

Information Disclosure Chatwoot

5.4

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

1

CVE Published

Aug 19, 2022 - 13:15 nvd

MEDIUM 5.4

DescriptionNVD

Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0.

AnalysisAI

Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-922. Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0. Affected products include: Chatwoot. Version information: prior to 2.6.0..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Chatwoot

View all

CVE-2022-3741 CRITICAL Act Now POC

Impact varies for each individual vulnerability in the application. Rated critical severity (CVSS 9.8), this vulnerabili

CVE-2021-3649 HIGH This Week POC

chatwoot is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability

CVE-2022-2901 HIGH This Week POC

Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8. Rated high severity (CVSS 7.1), this vulnera

CVE-2022-0542 MEDIUM This Month POC

Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0. Rated medium severity (CVSS 6.1)

CVE-2022-1022 MEDIUM This Month POC

Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0. Rated medium severity (CVSS 5

CVE-2024-0640 MEDIUM This Month POC

A stored cross-site scripting (XSS) vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1. Rated medium seve

CVE-2026-44706 HIGH This Week

SQL injection in Chatwoot versions 2.2.0 through 4.11.1 allows any authenticated account user to execute arbitrary SQL v

CVE-2026-44707 MEDIUM This Month

Pre-Account Takeover in Chatwoot's OmniAuth integration affects all releases from 2.14.0 through 4.12.x, allowing an att

CVE-2025-12246 LOW Monitor POC

Cross-site scripting (XSS) in Chatwoot up to version 4.7.0 allows remote attackers to inject malicious scripts via the L

CVE-2023-2109 MEDIUM This Month

Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0. Rated medium severity (CVSS 6.1

CVE-2026-4990 MEDIUM This Month

Improper authorization in Chatwoot up to version 4.11.1 allows remote unauthenticated attackers to bypass authentication

CVE-2026-5205 LOW Monitor

Server-side request forgery (SSRF) in Chatwoot up to version 4.11.2 allows authenticated remote attackers to manipulate

Same weakness CWE-922 – Insecure Storage of Sensitive Information

View all

CVE-2023-29727 CRITICAL POC

CVE-2021-27170 CRITICAL POC

CVE-2017-7253 HIGH POC

CVE-2025-28244 HIGH POC

CVE-2025-46627 HIGH POC

CVE-2024-22773 HIGH POC

CVE-2023-32184 HIGH POC

CVE-2023-29757 HIGH POC

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

CVE-2023-7028 CRITICAL POC

CVE-2017-0213 HIGH POC

Share

CVE-2022-1021 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy