Approved changes feed: RSS · Atom
cpe:2.3:a:catchethq:catchet:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Catchethq (62606d72-a56a-5bf9-8b6d-1e955bd4306f) |
|---|---|
| Product | Catchet (1e954582-d119-5aa1-b493-47a3e0d4a9f8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:composer/cachethq/cachet |
purl2cpe | 2026-06-01 10:14:46.036747 |
pkg:github/cachethq/cachet |
purl2cpe | 2026-06-01 10:14:46.036748 |
pkg:golang/github.com/cachethq/cachet |
purl2cpe | 2026-06-01 10:14:46.036750 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-39174 |
vulnerable | 2026-06-08 05:33:49.090863 |
Configuration leak
HIGH (8.8)
Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can leak the value of any configuration entry of the dotenv file, e.g. the application secret (`APP_KEY`) and various passwords (email, database, etc). This issue was addressed in version 2.5.1 by improving `UpdateConfigCommandHandler` and preventing the use of nested variables in the resulting dotenv configuration file. As a workaround, only allow trusted source IP addresses to access to the administration dashboard.
Published: 2021-08-27T23:25:08.000Z
Updated: 2024-08-04T01:58:18.255Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-39173 |
vulnerable | 2026-06-08 05:33:49.090487 |
Forced reinstall
HIGH (8.8)
Cachet is an open source status page system. Prior to version 2.5.1 authenticated users, regardless of their privileges (User or Admin), can trick Cachet and install the instance again, leading to arbitrary code execution on the server. This issue was addressed in version 2.5.1 by improving the middleware `ReadyForUse`, which now performs a stricter validation of the instance name. As a workaround, only allow trusted source IP addresses to access to the administration dashboard.
Published: 2021-08-27T23:00:09.000Z
Updated: 2024-08-04T01:58:18.192Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-39172 |
vulnerable | 2026-06-08 05:33:49.090006 |
New line injection during configuration edition
HIGH (8.8)
Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can exploit a new line injection in the configuration edition feature (e.g. mail settings) and gain arbitrary code execution on the server. This issue was addressed in version 2.5.1 by improving `UpdateConfigCommandHandler` and preventing the use of new lines characters in new configuration values. As a workaround, only allow trusted source IP addresses to access to the administration dashboard.
Published: 2021-08-27T22:50:09.000Z
Updated: 2024-08-04T01:58:18.282Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.