CVE-2021-39173 json
Forced reinstall
published 5y ago modified 4mo ago also GHSA-r67m-m8c7-jp83 , EUVD-2021-1857
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.4%
- EPSS 2.4% chance of exploitation in 30 days, percentile 83%
- public exploits
- 0
- none known
Summary
Cachet is an open source status page system. Prior to version 2.5.1 authenticated users, regardless of their privileges (User or Admin), can trick Cachet and install the instance again, leading to arbitrary code execution on the server. This issue was addressed in version 2.5.1 by improving the middleware `ReadyForUse`, which now performs a stricter validation of the instance name. As a workaround, only allow trusted source IP addresses to access to the administration dashboard.
Patch / fix
- packagist cachethq/cachet 2.5.1
- catchethq catchet 2.5.1
Is CVE-2021-39173 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
2.36% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- blog.sonarsource.com https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | cachethq/cachet | <2.5.1 |
2.5.1 |
Affected products
- fiveai Cachet
Classification
- Weakness
-
- CWE-704 Incorrect Type Conversion or Cast
References
-
blog.sonarsource.com
/cachet-code-execution-via-laravel-configuration-injection/
exploit, third-party-advisory
-
github.com
/fiveai/Cachet/releases/tag/v2.5.1
web, release-notes, third-party-advisory
-
github.com
/fiveai/Cachet/security/advisories/GHSA-r67m-m8c7-jp83
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-39173
advisory
-
blog.sonarsource.com
/cachet-code-execution-via-laravel-configuration-injection
web
-
github.com
/fiveai/Cachet
package
Sources
- CVE List CVE-2021-39173
- GitHub Advisory GHSA-r67m-m8c7-jp83
- NVD CVE-2021-39173
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.