Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

Chatwoot: Password Change Leaves Old Sessions Active

CVE-2021-3740 · published 1 year ago
Summary

Old sessions remain active after changing a password, potentially allowing unauthorized access. This issue affects Chatwoot versions prior to 2.4.0. To protect your users, update to the latest version of Chatwoot as soon as possible.

What to do
  • Update chatwoot chatwoot to version 2.4.0 or later.
Affected software
VendorProductAffected versions
chatwoot chatwoot < 2.4.0
cpe:2.3:a:chatwoot:chatwoot:*:*:*:*:*:*:*:*
Original advisory text
A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions on other devices when a user changes their password, allo...
A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions on other devices when a user changes their password, allowing old sessions to persist. This can lead to unauthorized access if an attacker has obtained a session token.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
6.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-384Session Fixation
Timeline
Published15 Nov 2024
Updated29 Oct 2026
First seen7 Mar 2026
Sources
CVE-2021-3740 · NVD
Track software like this
Free during beta