MISP EUVD-2026-30168

Attacker must be able to reach the MISP web application's event listing or shadow attribute listing endpoints over the network and must supply the vulnerable sort/order request parameter; while the CVSS 4.0 vector specifies PR:N (no privileges), the description's wording 'an attacker with access to the affected endpoints' suggests an authenticated MISP user session is the realistic precondition for most deployments - defenders should confirm endpoint auth requirements against the GHSA advisory. Exploitation success additionally depends on the privileges granted to MISP's database account (broader privileges enable larger data exposure or modification) and on the absence of WAF or reverse-proxy filtering of SQL metacharacters in query string parameters. The platform-agnostic nature of MISP means any supported MySQL/MariaDB backend is potentially in scope.

Signals diverge sharply here and warrant careful weighting. CVSS 4.0 rates this 9.3 critical with AV:N/AC:L/AT:N/PR:N/UI:N - network-reachable, low complexity, no privileges, no user interaction - and high impact on confidentiality, integrity, and availability of the vulnerable component. However, EPSS is only 0.04% (11th percentile), SSVC marks Exploitation as 'none' and Automatable as 'no', and the vulnerability is not in CISA KEV. The PR:N rating in CVSS conflicts with the description's phrase 'attacker with access to the affected endpoints,' which suggests these endpoints may require an authenticated MISP user session in typical deployments - verify endpoint authentication requirements against the GHSA advisory before assuming pre-auth exploitability. The 'Authentication Bypass' tag in the input data is not substantiated by the description and should be treated with skepticism. Practical risk is elevated for internet-exposed MISP instances and for organizations sharing intelligence with untrusted partners, but lower for MISP deployments restricted to trusted analyst networks.

An attacker with access to a vulnerable MISP instance issues an HTTP request to an event or shadow attribute listing endpoint, supplying a crafted value in the sort or order parameter (for example a SQL fragment, time-based blind injection payload, or stacked subquery) that gets concatenated into the ORDER BY clause. Depending on database privileges, the attacker can extract event content and attributes through blind or error-based techniques, infer schema, or alter query behavior to retrieve unauthorized intelligence records. No public exploit identified at time of analysis, but ORDER BY injection techniques are well-documented and trivially reproducible once the vulnerable parameter is identified.