Unauthenticated SQL Injection in Cachet

中 6.5CVE-2021-39165 · GHSA-79mg-4w23-4fqc · 26/08/2021 公開 · 17/06/2026 更新

要点

CVE-2021-39165 は cachethq/cachet, cachet (chachethq) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：8.2%（全脆弱性の 94.9% より高い）。
対処：2.3.18 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
cachethq/cachet Packagist	`≤ 2.3.18`	修正版なし
cachet chachethq	`< 2.3.18`	`2.3.18`

概要

Impact

In Cachet versions through 2.3.18, there is a SQL injection which is in the SearchableTrait#scopeSearch(). Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session.

Patches

The original repository of https://github.com/CachetHQ/Cachet is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.

Update to version 2.5 or later in the https://github.com/fiveai/Cachet fork to fix this vulnerability.

NVD の説明

Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. The original repository of Cachet <https://github.com/CachetHQ/Cachet> is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.