CVE-2021-39165

Name of the Vulnerable Software and Affected Versions Cachet versions prior to 2.5

Description The issue is a SQL injection vulnerability located in the SearchableTrait#scopeSearch() function. This vulnerability can be exploited by attackers without authentication to exfiltrate sensitive data from the database, including administrator passwords and sessions.

Recommendations Update to version 2.5 or later in the https://github.com/fiveai/Cachet fork to fix this vulnerability. As a temporary workaround, consider restricting access to the SearchableTrait#scopeSearch() function until a patch is available.