Unauthenticated SQL Injection in Cachet

TRUNG BÌNH 6.5CVE-2021-39165 · GHSA-79mg-4w23-4fqc · Công bố 26/08/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-39165 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng cachethq/cachet, cachet (chachethq).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 8.2%, cao hơn 94.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.3.18 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
cachethq/cachet Packagist	`≤ 2.3.18`	Chưa có bản vá
cachet chachethq	`< 2.3.18`	`2.3.18`

Mô tả

Impact

In Cachet versions through 2.3.18, there is a SQL injection which is in the SearchableTrait#scopeSearch(). Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session.

Patches

The original repository of https://github.com/CachetHQ/Cachet is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.

Update to version 2.5 or later in the https://github.com/fiveai/Cachet fork to fix this vulnerability.

Mô tả của NVD

Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. The original repository of Cachet <https://github.com/CachetHQ/Cachet> is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.