CVE-2021-39173

{"containers": {"cna": {"affected": [{"product": "Cachet", "vendor": "fiveai", "versions": [{"status": "affected", "version": "< 2.5.1"}]}], "descriptions": [{"lang": "en", "value": "Cachet is an open source status page system. Prior to version 2.5.1 authenticated users, regardless of their privileges (User or Admin), can trick Cachet and install the instance again, leading to arbitrary code execution on the server. This issue was addressed in version 2.5.1 by improving the middleware `ReadyForUse`, which now performs a stricter validation of the instance name. As a workaround, only allow trusted source IP addresses to access to the administration dashboard."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-704", "description": "CWE-704: Incorrect Type Conversion or Cast", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-08-02T15:13:11.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/fiveai/Cachet/releases/tag/v2.5.1"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/fiveai/Cachet/security/advisories/GHSA-r67m-m8c7-jp83"}, {"tags": ["x_refsource_MISC"], "url": "https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/"}], "source": {"advisory": "GHSA-r67m-m8c7-jp83", "discovery": "UNKNOWN"}, "title": "Forced reinstall", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-39173", "STATE": "PUBLIC", "TITLE": "Forced reinstall"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Cachet", "version": {"version_data": [{"version_value": "< 2.5.1"}]}}]}, "vendor_name": "fiveai"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cachet is an open source status page system. Prior to version 2.5.1 authenticated users, regardless of their privileges (User or Admin), can trick Cachet and install the instance again, leading to arbitrary code execution on the server. This issue was addressed in version 2.5.1 by improving the middleware `ReadyForUse`, which now performs a stricter validation of the instance name. As a workaround, only allow trusted source IP addresses to access to the administration dashboard."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-704: Incorrect Type Conversion or Cast"}]}]}, "references": {"reference_data": [{"name": "https://github.com/fiveai/Cachet/releases/tag/v2.5.1", "refsource": "MISC", "url": "https://github.com/fiveai/Cachet/releases/tag/v2.5.1"}, {"name": "https://github.com/fiveai/Cachet/security/advisories/GHSA-r67m-m8c7-jp83", "refsource": "CONFIRM", "url": "https://github.com/fiveai/Cachet/security/advisories/GHSA-r67m-m8c7-jp83"}, {"name": "https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/", "refsource": "MISC", "url": "https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/"}]}, "source": {"advisory": "GHSA-r67m-m8c7-jp83", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T01:58:18.192Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/fiveai/Cachet/releases/tag/v2.5.1"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/fiveai/Cachet/security/advisories/GHSA-r67m-m8c7-jp83"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-39173", "datePublished": "2021-08-27T23:00:09.000Z", "dateReserved": "2021-08-16T00:00:00.000Z", "dateUpdated": "2024-08-04T01:58:18.192Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Cachet", "vendor": "fiveai", "versions": [{"status": "affected", "version": "< 2.5.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:catchethq:catchet:*:*:*:*:*:*:*:*", "matchCriteriaId": "E6F15FBF-A3DE-4A7F-BAD5-D2C410CAF357", "versionEndExcluding": "2.5.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cachet is an open source status page system. Prior to version 2.5.1 authenticated users, regardless of their privileges (User or Admin), can trick Cachet and install the instance again, leading to arbitrary code execution on the server. This issue was addressed in version 2.5.1 by improving the middleware `ReadyForUse`, which now performs a stricter validation of the instance name. As a workaround, only allow trusted source IP addresses to access to the administration dashboard."}, {"lang": "es", "value": "Cachet es un sistema de p\u00e1ginas de estado de c\u00f3digo abierto. versiones anteriores a 2.5.1 unos usuarios autenticados, independientemente de sus privilegios (Usuario o Administrador), pueden enga\u00f1ar a Cachet e instalar la instancia de nuevo, conllevando a una ejecuci\u00f3n de c\u00f3digo arbitrario en el servidor. Este problema fue solucionado en versi\u00f3n 2.5.1, al mejorar el middleware \"ReadyForUse\", que ahora lleva a cabo una comprobaci\u00f3n m\u00e1s estricta del nombre de la instancia. Como soluci\u00f3n, s\u00f3lo permita que direcciones IP de origen confiable accedan al panel de administraci\u00f3n."}], "id": "CVE-2021-39173", "lastModified": "2026-06-17T04:03:14.790", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-08-27T23:15:06.957", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/fiveai/Cachet/releases/tag/v2.5.1"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/fiveai/Cachet/security/advisories/GHSA-r67m-m8c7-jp83"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/fiveai/Cachet/releases/tag/v2.5.1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/fiveai/Cachet/security/advisories/GHSA-r67m-m8c7-jp83"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-704"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-704"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}