CVE-2021-39165

Katalog CVE

CVSS 6.5 · Medium EPSS 8,2%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada chachethq cachet. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. The original repository of Cachet <https://github.com/CachetHQ/Cachet> is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.

Rincian

Terbit di NVD

26 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-287: Improper Authentication

EPSS (30 hari)

8,2% peluang dieksploitasi; lebih tinggi dari 94,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/fiveai/Cachet/commit/27bca8280419966ba80c6fa283d985ddffa84bb6 patch · advisory pihak ketiga
• https://github.com/fiveai/Cachet/security/advisories/GHSA-79mg-4w23-4fqc advisory pihak ketiga