CVE-2022-2901

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-285

Affected software

Vendor	Product	Versions
chatwoot	chatwoot/chatwoot	>= unspecified, < 2.8

References

https://github.com/chatwoot/chatwoot/commit/329e8c37c8ebc1b3629c0c3830b0e3070a3adc2aPatch, Third Party Advisory
https://huntr.dev/bounties/cf46e0a6-f1b5-4959-a952-be9e4bac03feExploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/chatwoot/chatwoot/commit/329e8c37c8ebc1b3629c0c3830b0e3070a3adc2aPatch, Third Party Advisory
https://huntr.dev/bounties/cf46e0a6-f1b5-4959-a952-be9e4bac03feExploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Sep 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-290139.8A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands CVE-2022-290147.5A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrary files.CVE-2022-290175.5Bento4 v1.6.0.0 was discovered to contain a segmentation fault via the component /x86_64/multiarch/strlen-avx2.S.CVE-2022-290206.1ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar.CVE-2022-290219.8A buffer overflow vulnerability exists in the razerkbd driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Servic CVE-2022-290229.8A buffer overflow vulnerability exists in the razeraccessory driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of CVE-2022-290239.8A buffer overflow vulnerability exists in the razermouse driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Serv CVE-2022-290285.5A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcent CVE-2022-290295.5A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcent CVE-2022-29037.2The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object inj CVE-2022-290305.5A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcent CVE-2022-290315.5A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcent