Access Control Flaw in MISP Affects User Data Security
CVE-2023-24028

9.8CRITICAL

Key Information:

Vendor

Misp-project

Status
Misp
Vendor
CVE Published:
20 January 2023

What is CVE-2023-24028?

In MISP version 2.4.167, a significant access control vulnerability exists within the ACLComponent.php file, specifically affecting the decaying import function. This flaw can allow unauthorized users to gain access to sensitive operations, potentially leading to unauthorized modifications or exposure of critical user data. It is crucial for users of this version to apply necessary patches and review their ACL configurations to ensure robust security measures are in place.

References

https://github.com/MISP/MISP/commit/93bf15d3bd703a32ebfe8...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.