Local File Inclusion Vulnerability in MISP Affected by Custom Terms File Setting
CVE-2022-27243

7.8HIGH

Key Information:

Vendor

Misp

Status
Misp
Vendor
CVE Published:
18 March 2022

What is CVE-2022-27243?

A vulnerability in MISP prior to version 2.4.156 allows for Local File Inclusion (LFI) through the manipulation of the custom terms file setting. This flaw exposes users to potential data breaches, as it could enable attackers to access sensitive files on the server. Users of affected versions must update to mitigate risks associated with unauthorized file access.

References

https://github.com/MISP/MISP/commit/8cc93687dcd68e1774b55...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.