Misp-project vulnerabilities
We track 4 vulnerabilities in Misp-project products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on February 9, 2024.
Latest Misp-project vulnerabilities
- 9.8 Critical severity
Misp: Exposed Dangerous Method or Function
An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp.
- 7.5 High severity
Misp: Generation of Error Message Containing Sensitive Information
MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.
- 9.8 Critical severity
Misp: Improper Handling of Exceptional Conditions
MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.
- 7.5 High severity
Misp: Improper Authentication
An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header.