SQL Injection Risk in MISP Product by MISP Vendor
CVE-2022-48328

9.8CRITICAL

Key Information:

Vendor

Misp

Status
Misp
Vendor
CVE Published:
20 February 2023

What is CVE-2022-48328?

The MISP platform, prior to version 2.4.167, contains a vulnerability within the IndexFilterComponent.php file that improperly handles ordered_url_params and additional_delimiters. This flaw can be exploited to conduct SQL injection attacks, allowing an attacker to manipulate database queries by injecting malicious SQL code through crafted URL parameters. Such vulnerabilities can lead to unauthorized data access, data breaches, and overall system compromise. Users of affected versions are advised to upgrade to the patched version 2.4.167 or later to mitigate these risks.

References

https://github.com/MISP/MISP/commit/1edbc2569989f84479926...
https://github.com/MISP/MISP/commit/206f540f0275af2dd2a86...
https://github.com/MISP/MISP/compare/v2.4.166...v2.4.167

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.