misp-modules vulnerabilities
4 known vulnerabilities in misp-modules from MISP. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.2 Critical severity
misp-modules: Exposure of Sensitive Information to an Unauthorized Actor
The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model seri
- 9.2 Critical severity
misp-modules: Missing Authorization
The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application en
- 8.3 High severity
misp-modules: Server-Side Request Forgery
A Server-Side Request Forgery (SSRF) protection bypass existed in the html_to_markdown expansion module of misp-modules. The module attempts to prevent requests to loopback, private, link-local, and other restricted IP address ranges. However, IP addresses wer
- 9.3 Critical severity
misp-modules: Cross-Site Request Forgery
MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and earlier, a Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests