CVE-2022-3741

    Dashboard / Vulnerabilities / CVE-2022-3741

    CVE-2022-3741

    Published: 28 Oct 2022Last Modified: 28 Oct 2026

    Summary: Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot

    Details: Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output Status Code to separate accounts that are generated and waiting for email verification. \n\nFor the sign in directories, it is possible to brute force login attempts to either login portal, which could lead to account compromise.

    References: https://huntr.dev/bounties/46f6e07e-f438-4540-938a-510047f987d0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3741.json, https://nvd.nist.gov/vuln/detail/CVE-2022-3741, https://github.com/chatwoot/chatwoot/commit/9525d4f0346a2fdac13a0253f9180d20104a72d3

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -ce9c8645df2899dd508836d4dbc3448db8e13d33

    Affected versions

    v2.9.1
    v2.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-3741 | CVE-DB