Improper Input Validation in MISP Product by GitHub
CVE-2022-48329

9.8CRITICAL

Key Information:

Vendor

Misp

Status
Misp
Vendor
CVE Published:
20 February 2023

What is CVE-2022-48329?

A security issue in MISP prior to version 2.4.166 arises from improper input validation in various model files, enabling unauthorized users to manipulate the 'order' parameter. This could lead to situations where sensitive application data is exposed or altered. The vulnerability is tied to the app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php files. Users are advised to upgrade to the latest version to mitigate potential security risks.

References

https://github.com/MISP/MISP/commit/afbe08d256d609eee5195...
https://github.com/MISP/MISP/commit/a73c1c461bc6f8a048eae...
https://github.com/MISP/MISP/compare/v2.4.165...v2.4.166

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.