CVE-2021-39165

描述

### Impact In Cachet versions through 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. ### Patches The original repository of [https://github.com/CachetHQ/Cachet](https://github.com/CachetHQ/Cachet) is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected. Update to version 2.5 or later in the [https://github.com/fiveai/Cachet fork](https://github.com/fiveai/Cachet) to fix this vulnerability.

如何修補 CVE-2021-39165

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• —未列出修補版本

CVE-2021-39165 正在被利用嗎?

中等 — EPSS 為 9.8%,可持續追蹤但非最高優先。

受影響套件(1)

• from 0, <= 2.3.18

CVSS 分數

參考連結(3)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-39165
• WEBgithub.com/fiveai/Cachet/commit/27bca8280419966ba80c6fa283d985ddffa84bb6
• WEBgithub.com/fiveai/Cachet/security/advisories/GHSA-79mg-4w23-4fqc