{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-17T02:16:40.041","vulnerabilities":[{"cve":{"id":"CVE-2021-39173","sourceIdentifier":"security-advisories@github.com","published":"2021-08-27T23:15:06.957","lastModified":"2024-11-21T06:18:47.417","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Cachet is an open source status page system. Prior to version 2.5.1 authenticated users, regardless of their privileges (User or Admin), can trick Cachet and install the instance again, leading to arbitrary code execution on the server. This issue was addressed in version 2.5.1 by improving the middleware `ReadyForUse`, which now performs a stricter validation of the instance name. As a workaround, only allow trusted source IP addresses to access to the administration dashboard."},{"lang":"es","value":"Cachet es un sistema de páginas de estado de código abierto. versiones anteriores a 2.5.1 unos usuarios autenticados, independientemente de sus privilegios (Usuario o Administrador), pueden engañar a Cachet e instalar la instancia de nuevo, conllevando a una ejecución de código arbitrario en el servidor. Este problema fue solucionado en versión 2.5.1, al mejorar el middleware \"ReadyForUse\", que ahora lleva a cabo una comprobación más estricta del nombre de la instancia. Como solución, sólo permita que direcciones IP de origen confiable accedan al panel de administración."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-704"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-704"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:catchethq:catchet:*:*:*:*:*:*:*:*","versionEndExcluding":"2.5.1","matchCriteriaId":"E6F15FBF-A3DE-4A7F-BAD5-D2C410CAF357"}]}]}],"references":[{"url":"https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/","source":"security-advisories@github.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/fiveai/Cachet/releases/tag/v2.5.1","source":"security-advisories@github.com","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/fiveai/Cachet/security/advisories/GHSA-r67m-m8c7-jp83","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/fiveai/Cachet/releases/tag/v2.5.1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/fiveai/Cachet/security/advisories/GHSA-r67m-m8c7-jp83","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}