CVE-2021-39173

Katalog CVE

CVSS 8.8 · High EPSS 2,4%

Kerentanan Incorrect Type Conversion or Cast pada catchethq catchet. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Cachet is an open source status page system. Prior to version 2.5.1 authenticated users, regardless of their privileges (User or Admin), can trick Cachet and install the instance again, leading to arbitrary code execution on the server. This issue was addressed in version 2.5.1 by improving the middleware `ReadyForUse`, which now performs a stricter validation of the instance name. As a workaround, only allow trusted source IP addresses to access to the administration dashboard.

Rincian

Terbit di NVD

27 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-704: Incorrect Type Conversion or Cast

EPSS (30 hari)

2,4% peluang dieksploitasi; lebih tinggi dari 83,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/ exploit · advisory pihak ketiga
• https://github.com/fiveai/Cachet/releases/tag/v2.5.1 release notes · advisory pihak ketiga
• https://github.com/fiveai/Cachet/security/advisories/GHSA-r67m-m8c7-jp83 advisory pihak ketiga