EUVD-2026-83917
GHSA-g7f8-8jj3-3vcp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Classic CSRF: no attacker auth (PR:N) but victim must load a page (UI:R); impact is integrity-only modification of threat-intel attributes (I:H), no confidentiality or availability effect.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
Lifecycle Timeline
3DescriptionCVE.org
MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change.
The affected function did not properly enforce MISP’s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.
If successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.
The attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.
The main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.
Version affected: <2.5.47
Articles & Coverage 1
AnalysisAI
Cross-site request forgery in MISP's AttributesController::editField allows an attacker to silently alter threat-intelligence data - an attribute's value, type, category, comment, distribution settings or related timestamps - in any MISP instance where a user is currently logged in, simply by luring that user to an attacker-controlled web page. All MISP builds before 2.5.47 are affected because the editField action had been placed in CakePHP's Security->unlockedActions list, which switched off the framework's forged-request and form-tampering protection; the attacker needs no MISP account of their own (the CVSS vector carries PR:N, i.e. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the victim to be a currently-authenticated MISP user (valid active session) who visits an attacker-controlled web page during that session; the attack targets MISP versions before 2.5.47 where the editField action was placed in CakePHP's Security->unlockedActions, disabling CSRF protection. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate, integrity-only CSRF flaw (CWE-352) in MISP's AttributesController::editField, corroborated by the vendor CVSS 4.0 vector (7.1, AV:N/AC:L/PR:N/UI:P/VC:N/VI:H/VA:N) and the fix commit dfbae33f9, which shows editField had been added to Cake's Security->unlockedActions - disabling CSRF/form protection outright. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade MISP to 2.5.47 or later, which is the version band outside the affected <2.5.47 range and contains the fix that removes editField from CakePHP's Security->unlockedActions while preserving the CSRF token check; deployments tracking the upstream branch can apply commit dfbae33f9 directly (https://github.com/MISP/MISP/commit/dfbae33f9). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every MISP instance in the estate and confirm which run builds earlier than 2.5.47; the vendor-released patch is MISP 2.5.47 and should be applied first to internet-reachable instances and those supporting active incident response. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today