Description
Cachet is an open source status page system. Prior to version 2.5.1 authenticated users, regardless of their privileges (User or Admin), can trick Cachet and install the instance again, leading to arbitrary code execution on the server. This issue was addressed in version 2.5.1 by improving the middleware `ReadyForUse`, which now performs a stricter validation of the instance name. As a workaround, only allow trusted source IP addresses to access to the administration dashboard.
References (3)
Scores
CVSS v3
8.8
EPSS
0.0370
EPSS Percentile
88.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-704
Status
published
Products (2)
cachethq/cachet
0 - 2.5.1Packagist
catchethq/catchet
< 2.5.1
Published
Aug 27, 2021
Tracked Since
Feb 18, 2026