Client-side vulnerability in MISP before 2.4.184 allows unauthorized export generation
CVE-2024-25675

9.8CRITICAL

Key Information:

Vendor

MISP

Status
Misp
Vendor
CVE Published:
9 February 2024

What is CVE-2024-25675?

A significant security issue has been identified in MISP versions prior to 2.4.184, where the export generation process can be initiated by a client without the necessity of sending a POST request. This vulnerability impacts the application's JobsController.php and export.ctp files, potentially allowing unauthorized processes to commence. Users of MISP are encouraged to update to the latest version to mitigate any associated security risks.

References

https://github.com/MISP/MISP/compare/v2.4.183...v2.4.184
https://github.com/MISP/MISP/commit/0ac2468c2896f4be4ef92...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.