Skip to content
OpenAdvisories

Vendor

fiveai

4 known vulnerabilities.

Products

Cachet 4
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.8
    CVE-2021-39174 Public exploit

    Configuration leak

    Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can leak the value of any configuration entry of the dotenv file, e.g. the application secret (`APP_KEY`) and various pas…

    fiveai Cachet cachethq/cachet Packagist
  • High 8.8
    CVE-2021-39173

    Forced reinstall

    Cachet is an open source status page system. Prior to version 2.5.1 authenticated users, regardless of their privileges (User or Admin), can trick Cachet and install the instance again, leading to arbitrary code execution on the server. This issue was address…

    fiveai Cachet cachethq/cachet Packagist
  • High 8.8
    CVE-2021-39172 Public exploit EPSS 29%

    New line injection during configuration edition

    Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can exploit a new line injection in the configuration edition feature (e.g. mail settings) and gain arbitrary code execut…

    fiveai Cachet cachethq/cachet Packagist
  • High 8.1
    CVE-2021-39165 Public exploit

    Unauthenticated SQL Injection

    Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the da…

    fiveai Cachet cachethq/cachet Packagist