Authorization Bypass in MISP's Bookmarks Controller
CVE-2024-45509

6.5MEDIUM

Key Information:

Vendor

MISP

Status
Misp
Vendor
CVE Published:
1 September 2024

What is CVE-2024-45509?

In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin.

References

https://github.com/MISP/MISP/commit/3f3b9a574f349182a5456...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.