CVE-2022-3741

Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output Status Code to separate accounts that are generated and waiting for email verification. \n\nFor the sign in directories, it is possible to brute force login attempts to either login portal, which could lead to account compromise.

• CWE-307
• CWE-307

• https://github.com/chatwoot/chatwoot/commit/9525d4f0346a2fdac13a0253f9180d20104a72d3Patch, Third Party Advisory
• https://huntr.dev/bounties/46f6e07e-f438-4540-938a-510047f987d0Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/chatwoot/chatwoot/commit/9525d4f0346a2fdac13a0253f9180d20104a72d3Patch, Third Party Advisory
• https://huntr.dev/bounties/46f6e07e-f438-4540-938a-510047f987d0Exploit, Issue Tracking, Patch, Third Party Advisory

Published

Oct 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-37404Authenticated (admin+) Stored Cross-Site Scripting (XSS) vul…4.8
• CVE-2022-37405Cross-Site Request Forgery (CSRF) vulnerability in Mickey Ka…8.8
• CVE-2022-37406Cross-site scripting vulnerability in Aficio SP 4210N firmwa…4.8
• CVE-2022-37407Multiple Authenticated Stored Cross-Site Scripting (XSS) vul…5.4
• CVE-2022-37408Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-37409Insufficient control flow management for the Intel(R) IPP Cr…5.5
• CVE-2022-37410Improper access control for some Intel(R) Thunderbolt driver…7
• CVE-2022-37411Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Car…8.8
• CVE-2022-37412Authenticated (admin+) Reflected Cross-Site Scripting (XSS) …4.8
• CVE-2022-37415The Uniwill SparkIO.sys driver 1.0 is vulnerable to a stack-…7.8
• CVE-2022-37416Ittiam libmpeg2 before 2022-07-27 uses memcpy with overlappi…6.5
• CVE-2022-37418The Remote Keyless Entry (RKE) receiving unit on certain Nis…6.4