CVE-2021-39172: catchethq catchet

csirt@kutim:~/threat-intel/cve/CVE-2021-39172

CVSS 8.8 · High EPSS 29,2%

Kerentanan Improper Neutralization of CRLF Sequences ('CRLF Injection') pada catchethq catchet. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can exploit a new line injection in the configuration edition feature (e.g. mail settings) and gain arbitrary code execution on the server. This issue was addressed in version 2.5.1 by improving `UpdateConfigCommandHandler` and preventing the use of new lines characters in new configuration values. As a workaround, only allow trusted source IP addresses to access to the administration dashboard.

Rincian

Terbit di NVD: 27 Agustus 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
EPSS (30 hari): 29,2% peluang dieksploitasi; lebih tinggi dari 98,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
catchethq	catchet	Semua versi sebelum 2.5.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/ exploit · advisory pihak ketiga
https://github.com/fiveai/Cachet/releases/tag/v2.5.1 release notes · advisory pihak ketiga
https://github.com/fiveai/Cachet/security/advisories/GHSA-9jxw-cfrh-jxq6 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.