CVE-2021-39172

Cachet (open source status page system) prior to version 2.5.1 is vulnerable to a new line injection in the configuration edition feature (e.g., mail settings) that allows authenticated users, regardless of privilege, to achieve arbitrary code execution on the server. Root cause: insertion of new...

CVE-2021-39174

Cachet prior to 2.5.1 allows authenticated users (any privilege) to leak values from the dotenv configuration, including APP_KEY and passwords. The root cause is updates to the dotenv file via UpdateConfigCommandHandler without proper validation, enabling newline/newline-like entries and, in some...

CVE-2021-39173

CVE-2021-39173 affects Cachet (PHP-based open source status page) and describes a vulnerability where, before version 2.5.1, authenticated users could trigger a reinstall through the setup flow, potentially enabling arbitrary code execution on the server. The underlying issue stemmed from a lack ...