Misp
Monthly
MISP instances configured to force TOTP enrolment (Security.otp_required) could be used indefinitely by an authenticated user who never completed second-factor setup, because the enrolment guard in AppController::__verifyUser was enforced only for standard browser requests; AJAX/XHR calls, REST API requests, .json format URLs, restSearch queries and automation actions bypassed the check since those request shapes cannot follow the redirect to the TOTP page. The affected range is MISP versions below 2.5.48, and exploitation requires a valid authenticated session for an account that has not enrolled in TOTP and whose role lacks perm_skip_otp, with identities authenticated by API key explicitly exempt (logged_by_authkey). Assessed impact is high for confidentiality and integrity (CVSS 3.1 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), with no public exploit identified at time of analysis; risk is real but conditional on the non-default otp_required hardening setting, so patched builds should be applied on a normal, prioritized schedule rather than as an emergency.
Stored cross-site scripting in Sachertortephp (MISP's CakePHP-derived framework) lets an authenticated user who can control an attachment filename inject CR/LF or a double quote into the Content-Disposition header generated by CakeResponse::download(). A CR/LF causes PHP to drop the entire Content-Disposition header so the response body renders inline with its own Content-Type on the application origin, while a double quote permits injection of additional Content-Disposition parameters; the payload is stored via attribute downloads, proposal downloads, or restSearch exports and executes when another authenticated user views the affected page. No public exploit code has been identified at time of analysis; an upstream fix is available via vendor commits.
Improper authorization in MISP's correlation handling lets an authenticated user with at least read access to some events retrieve attribute values and event metadata from events they are no longer permitted to view, in deployments running MISP before v2.5.48. The leak occurs because correlation lookups are authorized against a point-in-time distribution snapshot stored on the correlation row, which carries no published flag, so the check diverges from the live event ACL once a correlated event is unpublished or moved to a different sharing group; the CVSS vector (PR:L) confirms the attacker must be authenticated, and no public exploit code has been identified at time of analysis. Impact is confined to confidentiality - read-only exposure bounded to those correlated events that were restricted after the correlation was created - making this a moderate-severity, measured-priority patch rather than an emergency.
Improper input validation in MISP's decaying model import endpoint allows an authenticated user with the perm_decaying permission to overwrite, re-own, or re-flag decaying models belonging to other organisations in MISP versions before 2.5.48. The import handler strips only the top-level id and uuid fields and pins org_id/default on the outer array before saving the record flat, so a nested 'DecayingModel' key can smuggle its own primary key, organisation identifier, and default flag past those guards, letting an attacker modify an existing model in place, reassign its organisation, or set it as the organisation default and thereby alter scoring behaviour for other users. This is a bounded authorization/mass-assignment flaw rather than an unauthenticated critical: successful exploitation requires network access to the instance plus an account holding perm_decaying (not granted to ordinary users by default), and there is no confidentiality or availability impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and an upstream fix commit (70e319e4b) exists.
Authorization bypass in MISP's event flattening feature lets an authenticated user who can view a community-distributed event retrieve attributes that belong to organisation-only objects (distribution level 0) or objects restricted to a specific sharing group they are not a member of. MISP versions below 2.5.48 drop the Object containment from the query when the flatten option is used and return those object attributes as top-level event attributes without re-applying the object's own distribution or sharing-group access check, resulting in unauthorized disclosure of sensitive threat intelligence. This is a genuine but access-gated information-disclosure flaw, not a high-urgency internet-wide threat: exploitation requires a valid authenticated account, an event the user's organisation can already see via community distribution, and that event containing at least one object whose distribution is more restrictive than the event itself; no public exploit identified at time of analysis.
MISP (Malware Information Sharing Platform) versions before v2.5.48 accept the same TOTP one-time code more than once, allowing a captured second-factor code to be replayed to open an additional authenticated session. The flaw is a CWE-294 capture-replay weakness: the login flow never recorded that a given TOTP time-step had already been consumed, so a code remained usable for its entire ~30-second validity window. Exploitation is conditional rather than drive-by - the targeted user must have TOTP enabled, the attacker must be able to observe or intercept the live code (network interception, shoulder surfing, or a compromised client) and in practice also hold the first-factor credentials, and the replay must land inside the same TOTP period; the vendor has released a fix in v2.5.48, and no public exploit code has been identified at time of analysis.
Second-factor authentication bypass in MISP versions before 2.5.48 lets an attacker who already holds a session past the password step and a copy of the HOTP paper-token list replay a previously consumed HOTP token, because the OTP check compared the submitted token against a counter cached in the user's session rather than the authoritative database counter; the stale cached value still matches the burned token, yielding a second successful login and rewinding the counter state. Exploitation is not anonymous: it requires an authenticated session (PR:L per the assessed vector, implying prior password compromise), HOTP paper-token 2FA explicitly enabled on the target account, and knowledge of at least one valid token value, per the assessed CVSS:3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (vendor CVSS 4.0 score 7.6, High). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in MISP 2.5.48 by commit f34aee2c7.
Stored cross-site scripting in MISP's event graph preview lets an authenticated user who can create or modify an event graph entry persist a malicious preview_img value that executes in the browser of a second user who opens the graph and triggers the preview popover. The stored value is concatenated directly into an img src attribute in app/webroot/js/event-graph.js, so a crafted string can break out of the attribute context and inject arbitrary JavaScript in the MISP origin, enabling session/cookie theft or actions performed as the victim; exploitation is bounded by the required prior authentication (PR:L) and mandatory victim interaction, and no public exploit code or confirmed active exploitation was identified at time of analysis. Only MISP instances running versions prior to fix commit 92c7ccc43, which landed after v2.5.48, are affected, making internet-exposed multi-user deployments the realistic risk surface.
Privilege escalation in MISP before 2.5.48 allows an authenticated user who holds the tag editor permission (perm_tag_editor) to smuggle sibling User and Organisation records into tag collection create or edit requests, which the affected controller then persists alongside the intended tag collection - letting the attacker create or modify accounts and escalate to site administrator. Exploitation requires network access to the instance and a delegated tag-editor role; no user interaction or administrative rights are needed, and the accompanying source fix (commit 96f735e7b) shipped in MISP 2.5.48. No public exploit code was identified at time of analysis, and instances that never delegate perm_tag_editor to non-administrative accounts are not exposed to an unprivileged external actor.
Cross-tenant record tampering in MISP (Malware Information Sharing Platform) versions before 2.5.48 lets any authenticated user holding the basic write role (perm_add) overwrite attribute values, re-parent objects into their own events, or soft-delete rows owned by other organizations and events they have no read access to. The root cause is that the CakePHP ORM's set() gives precedence to an attacker-supplied nested key matching the model alias, so MISP's sanitization (primary-key stripping, event_id/object_id pinning) is applied to the outer flat record while the ORM actually persists the inner attacker-controlled one; the independent assessment confirms this is a fully remote, low-complexity exploit (PR:L, no UI) with integrity-only impact that extends across tenants (SI:H), and no public exploit code or in-the-wild activity has been identified at time of analysis. A vendor fix is available via upstream commit 9485ae40d, with the affected range ending at MISP 2.5.48.
MISP before 2.5.48 lets an authenticated user holding the delegation permission (perm_delegate) retarget an existing event-delegation record to any event on the instance by injecting an 'id' or 'event_id' field into the delegation submission, because the controller authorizes only the event named in the URL but persists the entire caller-supplied record. The injected row grants the attacker's organisation read access to the targeted event and, if the target organisation accepts the delegation, transfers ownership of that event and deletes the original record - a confidentiality and integrity impact rated 8.7 (CVSS:4.0) and assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. Exploitation requires two concrete preconditions: an account with perm_delegate and the non-default, instance-wide MISP.delegation setting enabled; there is no public exploit identified at time of analysis, but a vendor fix is available in 2.5.48 (commit d1f5684f9).
Deserialization-based code execution is possible in MISP because PHP's phar stream wrapper is left registered in both the web entry point (app/webroot/index.php) and the console entry point (app/Console/cake.php), so any filesystem call on a caller-influenced path that resolves to a phar archive silently triggers an unserialize() of attacker-controlled metadata, or can reach executable code inside an uploaded phar under a relocated application root. The vendor's fix (commit 08fa755b6) simply unregisters the wrapper at startup, confirming that nothing in MISP, vendored CakePHP, or runtime libraries legitimately uses phar archives. Real-world risk is lower than the 7.7 CVSS 4.0 score suggests: the vector requires authentication (PR:L - a valid MISP account) and High attack complexity (AC:H), because no MISP/CakePHP/library code natively feeds a caller-influenced path into a phar-resolving operation, so a separate path-influence bug must be chained and no public exploit code has been identified at time of analysis.
Cross-site request forgery in MISP's AttributesController::editField allows an attacker to silently alter threat-intelligence data - an attribute's value, type, category, comment, distribution settings or related timestamps - in any MISP instance where a user is currently logged in, simply by luring that user to an attacker-controlled web page. All MISP builds before 2.5.47 are affected because the editField action had been placed in CakePHP's Security->unlockedActions list, which switched off the framework's forged-request and form-tampering protection; the attacker needs no MISP account of their own (the CVSS vector carries PR:N, i.e. unauthenticated from the attacker's perspective), but the forged request executes with the victim's session and is bounded by that victim's own edit permissions on the target attribute. Impact is integrity-only - no data disclosure or service disruption - rated 7.1 under both the vendor's CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P/VI:H) and the independently assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N); a vendor fix is available via commit dfbae33f9 and no public exploit code has been identified at time of analysis.
Server-side request forgery and arbitrary local file read in MISP before 2.5.47 allow an authenticated user holding permission to add or modify data to upload content through the MISP export/import file handler that the server treats as a file locator rather than an XML document, causing MISP to read local files off the server or issue outbound requests to internal-only services. Assessed CVSS 3.1 is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N (8.3 in the CNA's CVSS 4.0 vector), reflecting high confidentiality impact, scope change and no integrity or availability impact, with the blast radius on the SSRF branch bounded by what the MISP host can reach on the internal network. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; exploitation requires a valid MISP account with modify/add privileges (PR:L) and no victim interaction.
Arbitrary code execution in MISP (Malware Information Sharing Platform) before version 2.5.47 arises because the blocklist workflow module writes a user-supplied filename into the MISP export directory after applying only basename() path stripping and empty/dot checks, leaving the file extension unvalidated. An attacker holding the MISP site-administrator role - the only role permitted to invoke this workflow module (PR:H per the assessed vector) - can therefore place a file with an executable extension in that directory, and if the underlying web server is configured to interpret scripts there, the file executes with the web server user's privileges, compromising confidentiality, integrity and availability. This is a genuine CWE-434 unrestricted file upload, but exploitation is gated both by the high privilege requirement and by the non-default web server configuration that executes scripts from the export path; no public exploit identified at time of analysis, and the flaw is addressed by the vendor's extension allowlist fix in 2.5.47.
Privilege escalation in MISP before version 2.5.47 lets an authenticated holder of a read-only API key silently regain the complete permission set of the underlying user account. After authenticating with a view-only key, a single request to the updateLoginTime function causes MISP to re-login the session using the full account record, effectively discarding the API key's read-only restriction so the caller can perform write, delete, or administrative actions the key was meant to block. The flaw requires a valid read-only API key tied to an account that itself holds higher privileges, and escalation is bounded by those existing account permissions; no public exploit code has been identified at the time of analysis, and there is no KEV-listed active exploitation.
Cross-event EventReport disclosure and tampering in MISP versions before 2.5.47 lets an authenticated user who can submit module (enrichment) results reparent, read, or overwrite another event's report by supplying a forged 'id' field in the resolved module data. The root cause is an authorization bypass through a user-controlled key (CWE-639): the report loop in Event::processModuleResultsData did not unset the client-supplied 'id' before calling save(), so the CakePHP ORM updated an existing report row belonging to a different event instead of inserting a new one. Exploitation is gated by authentication and the module-result-submission privilege, and by knowledge of a valid target EventReport id; the independent assessment rates this a genuine but moderate authorization flaw rather than a mass-data-exposure issue, and no public exploit code was identified at time of analysis, though the vendor has published an upstream fix commit (4c1a03b20).
Stored cross-site scripting in the MISP Overmind theme allows an authenticated user with permission to create or rename an object, event, or server/feed identifier to inject markup that is later rendered as live HTML in another user's dashboard. When a victim opens the affected event General card or server/feed preview card, the donut-chart legend concatenates the stored name directly into an innerHTML string, executing attacker-supplied script in the MISP application origin and enabling session hijacking, data exfiltration, or actions performed as the victim. Our independent assessment rates this as a genuine but moderate-priority issue: exploitation requires the non-default Overmind theme to be active (PR:L, UI:P), impact scales with the victim's privilege level, and no public exploit was identified at time of analysis (EPSS 0.33%, 26th percentile; SSVC Exploitation: none, Automatable: no, Technical Impact: partial).
Remote code execution in MISP prior to 2.5.47 allows an authenticated attacker who can submit the platform's events/contact form to run arbitrary PHP as the MISP web user. By setting the contact form's 'person' field to a reserved CakePHP console switch such as '-app' and the adjacent 'message' field to a phar:// URI, the attacker redirects the background-job worker's application root into an attacker-controlled archive whose Config/core.php is then included - a deterministic, single-shot exploit requiring authenticated access to the submission endpoint (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, rated 8.7 under CVSS 4.0) and no timing or race condition. Exploitation status per available intelligence: no public exploit identified at time of analysis, EPSS is low at 0.50% (42nd percentile), and CISA SSVC records Exploitation: none, though the flaw is fully fixed only by upgrading to 2.5.47 and the impact of success is full server-side compromise of the web process.
MISP through 2.5.45 fails to enforce authorization checks when collection elements are created, allowing an authenticated user to persist a bare UUID referencing an Event or Galaxy Cluster they are not permitted to read. The collection view later resolves that UUID back into the underlying object, so collections become a handle on another organisation's private data — the patch notes this already caused org-only events to be disclosed in the beta collection view. Exploitation requires a valid MISP account and knowledge of the target UUID; no public exploit code or CISA KEV listing was identified at time of analysis, though the CVSS 4.0 vector (PR:L, VC:H) and EPSS-adjacent signals mark it as a meaningful confidentiality risk for shared threat-intel instances.
An authorization bypass in MISP through version 2.5.45 lets an authenticated user who can edit events assign an arbitrary sharing_group_id they are not authorized to use, because the authorization check only ran when the request explicitly supplied distribution = 4. If the caller omits the distribution field, MISP's field-recovery logic restores the event's stored distribution (4, for sharing-group events) and persists the unauthorized sharing group ID, silently re-scoping who can see that event and its threat-intelligence content. No public exploit code or active exploitation has been identified at time of analysis, but exploitation is a single crafted edit request, so the integrity impact (VI:H, CVSS 4.0 base 7.1) is significant for multi-tenant or community-sharing MISP instances.
Authentication bypass in MISP's optional LdapAuth and LinOTPAuth plugins (versions ≤2.5.45) lets a remote unauthenticated attacker log in as any user whose email they know, without a password. Because LdapAuthenticate and LinOTPAuthenticate reimplement CakePHP's FormAuthenticate but omit its _checkFields() non-empty-string guard, an empty/null password reaches ldap_bind() and - per RFC 4513 §5.1.2 - is treated as an unauthenticated bind that many directories accept as success; impersonation grants the victim's full privileges, potentially administrative. There is no public exploit identified at time of analysis, and SSVC lists exploitation as none, but the technical impact is rated total.
MISP's interactive CLI shell (≤2.5.45) enforces access control independently from the web application, creating at least six distinct authorization gaps that allow authenticated local users to retrieve sensitive credentials and bypass record-level ACLs. Feed HTTP authorization headers (Feed.headers), server synchronization authkeys, sharing-group memberships, and feed visibility restrictions are all enforced correctly in the web tier but not in the CLI, while the `use` command allows a user to establish an unauthorized record context without proving read rights. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the combination of plaintext credential disclosure and authorization bypass makes this a high-priority patch for any MISP deployment where non-site-admin personnel have shell access to the host.
Missing authorization in MISP's event template instantiation path allows authenticated users to write events into sharing groups they are not permitted to access, and to attach tags beyond their normal tagging permissions. Affected are all MISP deployments running version 2.5.45 and earlier. An attacker with a low-privilege account that can view a community-distributed template (distribution=1) may exploit the flaw to bypass `SharingGroup::canUse()` checks and additionally cause `local_only` tags to propagate globally through MISP's synchronization and export mechanisms, violating the isolation guarantees those tags exist to enforce.
Uncontrolled resource consumption in MISP ≤2.5.45 allows unauthenticated remote attackers to exhaust persistent storage by flooding the password-reset and related pre-authentication endpoints, each of which performs durable database writes before validating or throttling the caller. The `/users/forgot` endpoint accepted arbitrarily long, unvalidated email values and generated two write operations per request - an audit log entry and a queued background job - with no rate limit, enabling storage and job-queue exhaustion at modest request rates. The upstream fix (commit d75d899be, reported by CIRCL) adds a 1024-byte email length cap, format validation, a Redis-backed per-source flood filter with HTTP 429 responses, and a 15-minute API-access request cooldown; no public exploit or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in MISP ≤2.5.45 allows high-privileged users who configure threat intelligence feeds or TAXII discovery endpoints to cause MISP to make outbound HTTP requests to internal network resources and to exfiltrate configured feed authentication credentials to attacker-controlled hosts via unsanitized redirect following. A secondary incomplete SSRF defense in the TAXII discovery path failed to block IPv6 loopback (::1), hex-encoded addresses (0x7f000001), and multi-record DNS responses because it relied on gethostbyname() against a short literal blocklist. No public exploit code or active exploitation (CISA KEV) has been identified; patch commits are available upstream.
Missing authorization in MISP versions 2.5.45 and earlier exposes cryptographic signing key material - including raw key data, key type, and fingerprint - to any authenticated user on the platform, regardless of whether they are permitted to view the associated parent event. The CryptographicKeysController::view() handler fetched CryptographicKey records directly by supplied ID without resolving or authorizing the parent event, enabling cross-event key exfiltration within shared MISP instances. No public exploit has been identified at time of analysis; a patch is available in upstream commit 2edde619b.
Disk-exhaustion denial of service in MISP ≤2.5.45 is exploitable by any authenticated user, including read-only accounts, due to a wildcard ACL entry ('*') on the TemplatesController::uploadFile() endpoint. The handler writes uploaded content to app/tmp/files/ without verifying that the caller holds the perm_add or perm_template role, allowing repeated uploads to consume server disk space. The fix commit explicitly rules out escalation to RCE, stored XSS, or path traversal - impact is availability-only. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authorization bypass in MISP's UiBeta theme collection view exposes full event details - including identifiers, info fields, timestamps, creator organization, all event tags, and galaxy clusters - to authenticated users who lack ACL permissions to those events. The UiBeta theme's `view.ctp` template performed an independent secondary database query using only `Event.uuid IN (...)` without invoking `createEventConditions()`, the canonical per-user ACL enforcement method, even though `CollectionsController::view()` correctly filtered events via `Event::fetchSimpleEvents($user, ...)`. The flaw is compounded because `CollectionElementsController::add()` accepts arbitrary UUIDs from collection owners without validating the submitter's authorization against the referenced event, making collection elements an attacker-controlled input to an unfiltered query. No public exploit code has been identified at time of analysis and no CISA KEV listing exists.
Cross-site request forgery in MISP's sharing group quick-edit feature allows an unauthenticated attacker to manipulate threat intelligence sharing group membership by tricking a privileged MISP user into loading a crafted URL. The root cause is that HTTP method enforcement - which should have restricted the addOrg, removeOrg, addServer, and removeServer actions to POST-only - was commented out in the shared helper __initialiseSGQuickEdit(), leaving all four endpoints reachable via GET. Successful exploitation can silently add or remove organisations and servers from a sharing group, potentially exposing sensitive threat intelligence to unintended recipients or severing legitimate information-sharing relationships.
Incorrect authorization in MISP allows any authenticated user who is a member of an event-owning organization to delete individual attributes or perform bulk attribute deletion from that event, regardless of whether their assigned role carries `perm_modify` or `perm_modify_org` permissions. Three deletion controller actions in `AttributesController.php` - `delete()`, `deleteSelection()`, and `deleteSelected()` - relied only on organization membership checks inside `MispAttribute::deleteAttribute()` rather than on MISP's authoritative `ACL::canModifyEvent()` gate, which attribute editing operations correctly invoked. No public exploit has been identified, but the integrity impact is significant for any collaborative MISP deployment because deleted threat intelligence attributes cannot trivially be recovered.
Sharing Group authorization bypass in MISP allows an authenticated user with attribute or Galaxy Cluster creation permissions to associate objects with Sharing Groups they are not permitted to use. The flaw resides in AttributesController and GalaxyClustersController, where authorization checks against the Sharing Group were only invoked when the request explicitly set distribution == 4 - an attacker can craft a request containing sharing_group_id while omitting or manipulating the distribution parameter, causing the membership verification to be skipped entirely. Successful exploitation can silently breach organizational information-sharing boundaries, injecting data into restricted Sharing Groups and potentially distributing it to unauthorized member organizations. No public exploit has been identified at time of analysis.
Persistent denial of service in MISP's event template subsystem allows an authenticated user with event-template write permissions to store malformed JSON as a template definition by bypassing semantic validation. When any authenticated user subsequently loads the event template index - an endpoint accessible to all authenticated users - an unhandled exception in afterFind() causes HTTP 500 errors instance-wide until an administrator manually repairs the offending database row. The patch enforces strict array-only validation on save and adds exception handling on retrieval with graceful degradation to an empty definition.
Session fixation in MISP's optional CustomAuth flow lets an attacker who pre-plants a known session identifier silently inherit a victim's fully authenticated MISP session after the victim logs in, gaining all privileges of the victim's account including access to shared threat intelligence, event data, and administrative functions. The flaw is confined to deployments explicitly configured to use CustomAuth - standard authentication modes are unaffected. Vendor patch is available at commit e2eb2f058; no public exploit identified at time of analysis.
Unlimited OTP brute-force against MISP's email-based two-factor authentication allows an attacker holding valid primary credentials to bypass the second factor and fully compromise a target account. The email_otp() endpoint applied no rate limiting or lockout, and the OTP is scoped to the user rather than the login session - enabling multiple concurrent sessions to hammer the same valid OTP simultaneously. Patch available via commit 8658062ea; no public exploit identified at time of analysis.
CSRF in MISP's cullEmptyEvents endpoint allows a network attacker to trigger irreversible mass deletion of published empty events by causing an authenticated, privileged MISP user's browser to auto-request a crafted URL - for example via an embedded image tag. The endpoint accepted HTTP GET requests, which CakePHP's SecurityComponent does not CSRF-validate because GET requests carry no body, causing the framework's hasData check to return false and bypass token enforcement. The deletion is particularly destructive because it runs with skipBlocklist set, meaning purged events leave no blocklist entries to prevent or track subsequent re-synchronization; fix commits are available on GitHub, though the exact patched release version is not independently confirmed. No public exploit code is identified at time of analysis.
Improper TLS certificate validation in MISP's CurlClient class allows an adjacent-network attacker to perform man-in-the-middle attacks against outbound HTTPS connections made by the MISP instance, including threat intelligence synchronization. The PHP property `CurlClient::$verifyPeer` was left uninitialized, defaulting to null, which cURL interprets as falsy and therefore disables peer certificate verification. A successful attacker can observe authentication material and exchanged threat intelligence, and inject falsified data into MISP's responses from remote services. No public exploit has been identified; SSVC rates exploitation as none at time of analysis.
Authentication bypass in MISP's LDAP and LinOTP login components lets a remote unauthenticated attacker impersonate an existing directory user by submitting an empty password for a known account email. The custom LdapAuthenticate and LinOTPAuthenticate classes replaced CakePHP's FormAuthenticate but omitted its credential-validation guard, so empty or non-string values reached ldap_bind() (which succeeds against directories permitting unauthenticated binds) or a local password hash derived from an empty string. If the impersonated account is privileged, the attacker gains full access to threat-intelligence data and configuration. No public exploit identified at time of analysis; a vendor patch (commit 0ee058548) is available.
Denial-of-service in misp-stix allows remote attackers to terminate long-running MISP importer processes or exhaust host memory and CPU by submitting malformed or oversized STIX 1 or STIX 2 documents. Two distinct conditions combine: parsing failures invoked sys.exit(), which raises SystemExit - a BaseException subclass that bypasses standard except Exception handlers in callers - causing unconditional process termination instead of a recoverable error; and the library materialized full document content in memory before applying any size or validity checks, with processing costs of 2-7x the raw input size enabling resource exhaustion. No public exploit identified at time of analysis; upstream fix commits are available on GitHub.
Path traversal in the misp-stix Python library allows an attacker who can supply crafted STIX 2 content to escape the configured object-template directory during PyMISP template resolution, reading arbitrary files accessible to the conversion process and copying their contents into converted MISP objects. All MISP deployments performing STIX 2 import or MISP-to-STIX 2 export via misp-stix are affected, with the flaw carrying a CVSS 4.0 score of 8.8. No public exploit or CISA KEV listing exists at time of analysis, but the vulnerability's persistent re-triggering pathway - where a poisoned MISP event is later re-exported by a higher-privilege process - represents a privilege-escalation risk beyond what the base score alone reflects.
Cross-site request forgery in CTI-Transmute's administrative user deletion endpoint enables unauthenticated remote attackers to delete arbitrary user accounts by inducing an authenticated administrator to follow a crafted link. The /account/delete/<id> endpoint accepted HTTP GET requests for an irreversible state-modifying operation, allowing any web page or email to silently trigger deletions using the victim's active session. No public exploit has been identified at time of analysis, though the attack requires no attacker credentials and depends solely on social engineering a logged-in administrator.
Uncontrolled resource consumption in CTI-Transmute's unauthenticated /activity_timeline endpoint allows remote attackers to exhaust database, CPU, and memory resources by submitting arbitrarily large values for the `days` query parameter. All versions of the MISP project's CTI-Transmute tool are affected until the upstream patch is applied; the fix clamps the parameter to a 1-1,095 day range. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 (VA:H, PR:N, AC:L) reflects that this is a trivially reachable denial-of-service with no authentication barrier.
Server-side request forgery in CTI-Transmute's evaluation report PDF-generation pipeline allows an attacker who can inject content into a CTI evaluation report to coerce the application server into fetching arbitrary internal or filesystem resources. The vulnerability arises because user-controlled fields - conversion names, descriptions, and comments - flow through a Markdown-to-HTML conversion and are then rendered to PDF by WeasyPrint with its default unrestricted URL-fetching behavior intact, meaning crafted file:// or http(s):// references embedded in that content are fetched by the server process at render time. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but a patch commit is available from the MISP project.
Open redirect in MISP installation scripts allows unauthenticated remote attackers to craft malicious URLs that leverage a missing trailing slash in the Apache HTTP-to-HTTPS redirect directive. When a user follows a crafted link on the legitimate MISP domain, the redirect appends attacker-controlled path content directly to the hostname, causing the browser to interpret the attacker’s domain as the destination host. This can lead to phishing and credential collection, though no active exploitation has been identified and a vendor patch is available.
Server-Side Request Forgery bypass in the html_to_markdown expansion module of misp-modules lets an authenticated attacker reach internal, loopback, and link-local services that the module's IP range filtering was meant to block. By supplying an IPv4-mapped IPv6 address such as http://[::ffff:169.254.169.254]/ (or a hostname resolving to one), the attacker defeats the blocked-range checks and can pull back internal content — including cloud instance metadata — rendered back to them as Markdown. No public exploit identified at time of analysis and it is not in CISA KEV, but the underlying IPv4-mapped-IPv6 filter bypass is a well-understood, easily reproduced technique.
Authenticated arbitrary code execution in MISP allows a site administrator to abuse the Kafka_rdkafka_config setting to load an attacker-controlled INI file, which is parsed and passed to rdkafka with options such as plugin.library.paths to load an arbitrary shared library. The flaw (CWE-829, inclusion of functionality from untrusted control sphere) yields code execution as the MISP process user; no public exploit identified at time of analysis, but a vendor patch is available.
Remote code execution in MISP allows authenticated site administrators to abuse the JsonLogTool NDJSON error log configuration to write attacker-controlled content to a PHP file under the webroot, yielding code execution as the web server user. No public exploit identified at time of analysis, but a vendor patch is available via the MISP GitHub repository.
Multiple OAuth 2.0 flow weaknesses in the MISP AAD (Azure Active Directory) authentication plugin allow session hijacking, session fixation, CSRF/replay against the OAuth callback, plaintext credential exposure over non-HTTPS redirect URIs, and log injection. The plugin reused the PHP session_id() as the OAuth state parameter, never rotated the session ID after login, did not enforce HTTPS on the redirect URI, and logged attacker-controlled GET parameters verbatim. No public exploit identified at time of analysis, but an upstream fix is available in MISP commit 146bc40.
Cross-organization data tampering in MISP (Malware Information Sharing Platform) core allows authenticated low-privileged users to modify or delete intelligence objects belonging to other organizations by exploiting broken access-control checks across Event Reports, Collection Elements, Analyst Data, Template Elements, and Decaying Models. The flaw stems from authorization being performed against the wrong entity ID or being entirely absent on write paths, enabling integrity attacks on shared threat intelligence. Vendor patches are available via multiple MISP GitHub commits; no public exploit identified at time of analysis.
Broken access control in MISP Core's bulk deletion handlers lets any authenticated user holding the broad perm_add or perm_sharing_group role flag hard-delete Event Reports and Sharing Groups belonging to other organisations across the entire instance. The flaw affects MISP threat-intelligence platform deployments and enables cross-tenant data destruction by contributor-level accounts; no public exploit identified at time of analysis, but the upstream patch commits are public and trivially reverse-engineerable.
Insecure direct object reference flaws in MISP threat-intelligence platform allow an authenticated user with access to any one authorized object to overwrite, re-parent, or transfer ownership of objects belonging to other users or organizations by submitting crafted REST/form payloads containing attacker-chosen primary keys and ownership foreign keys. The root cause is CRUDComponent::edit() mass-assigning payload-supplied IDs (id, event_id, org_id, user_id, sharing_group_id, etc.) onto the already-loaded record, so CakePHP's save() updates a different row than the one the authorization check validated. No public exploit identified at time of analysis, but a vendor patch is available and the high CVSS 4.0 score of 9.4 reflects broad cross-tenant impact.
Privilege escalation in MISP threat intelligence platform versions through 2.5.38 allows authenticated users to modify other users' account attributes by submitting a crafted User.id parameter in edit requests. The UsersController::edit() function failed to strip user-supplied identifiers before processing, enabling cross-account modifications. No public exploit identified at time of analysis, but the source code fix is publicly visible in the upstream commit.
Authorization bypass in MISP versions through 2.5.38 lets authenticated users delete records via HTTP DELETE requests even after the application's delete-validation callback has rejected the operation. The root cause is an operator-precedence bug in the CRUDComponent::delete() handler where missing parentheses caused validation checks to be skipped for the DELETE method. No public exploit identified at time of analysis, but the upstream fix commit on GitHub publicly discloses the exact one-line vulnerable expression, making weaponization trivial.
OTP authentication bypass in MISP affects deployments where LdapAuth.mixedAuth=true is combined with Security.require_otp=true, allowing attackers with valid LDAP (or other plugin) credentials to skip the mandatory second factor. Because the plugin-driven login establishes the session during the AppController beforeFilter phase, an attacker can authenticate, ignore the /users/otp challenge page, and browse directly to any authorized application URL as the victim. No public exploit identified at time of analysis, though the upstream commit clearly documents the bypass technique.
Insecure Direct Object Reference in MISP 2.5.0 through 2.5.37 allows authenticated users with shadow attribute submission privileges to overwrite arbitrary existing ShadowAttribute records by supplying a target id within the add proposal request. The framework's ORM interprets a client-supplied primary key as an update directive, breaking the boundary between proposal creation and modification. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Privilege escalation in MISP threat intelligence platform versions prior to 2.5.37 allows organization administrators to reset authentication keys of site administrator accounts within the same organization, yielding cross-tier access takeover. The flaw stems from missing authorization checks in the auth key reset workflow, enabling an org-admin to harvest a freshly generated site-admin API key. No public exploit identified at time of analysis, and EPSS rates exploitation probability at just 0.06%, but a vendor-released patch (2.5.37) is available.
SQL injection in MISP threat intelligence platform versions prior to 2.5.37 allows remote unauthenticated attackers to manipulate ORDER BY clauses in event and shadow attribute listing endpoints by supplying crafted ordering parameters. The CVSS 4.0 score of 9.3 reflects high impact across confidentiality, integrity, and availability, though EPSS exploitation probability sits at just 0.04% and no public exploit identified at time of analysis. Given MISP's role as a repository of sensitive threat-intelligence data shared between organizations, successful exploitation could expose IOCs, attribution data, and partner-shared intelligence.
LDAP injection in MISP (Malware Information Sharing Platform) versions prior to 2.5.36 enables unauthenticated attackers to bypass authentication and execute unauthorized LDAP queries. The vulnerability exists in ApacheAuthenticate.php when administrators configure apacheEnv to use user-controlled server variables instead of REMOTE_USER in proxy deployments. Attackers manipulate unsanitized username values to inject special characters into LDAP search filters, potentially gaining unauthorized access to the threat intelligence platform. No public exploit identified at time of analysis.
Silent threat-intelligence data loss occurs in MISP deployments that federate objects: when a user with object-creation privileges saves a MISP Object with an empty description, the originating instance accepts it, but the receiving instance during synchronization rejects it and silently drops the object together with all of its associated attributes. The flaw affects versions below 2.5.48 and requires an authenticated object creator (CVSS 4.0 PR:L) in a multi-instance sync topology, so it is a low-urgency data-integrity defect rather than an externally exploitable breach; no public exploit identified at time of analysis, and the root cause is fixed upstream by the validation change in MISP commit 6b1776f07.
Concurrent HTTP POST requests to MISP's email OTP login endpoint can both authenticate using the same one-time password, breaking the single-use guarantee and establishing duplicate sessions. Affected versions before 2.5.48 are vulnerable when email OTP login is enabled; exploitation requires the attacker to already hold a valid, unexpired OTP (via interception or social engineering) and to time two requests within the narrow race window. No public exploit code or active exploitation has been identified, and the independent assessment rates this as a genuine but low-urgency integrity issue (CVSS 3.1 base 3.6, high attack complexity) because success merely duplicates a session the OTP already granted.
MISP installations prior to 2.5.48 fail to refresh event correlations after an authenticated user with write access changes an event's distribution level or sharing group, because the before-save hook recorded the incoming (new) values instead of the already-persisted ones and the subsequent after-save comparison therefore found no change to act on. The practical effect is unintended information disclosure: correlations computed under a broader sharing scope can remain visible to members of the previously wider group even after the event has been moved into a more restrictive one, while distribution widening can conversely leave newly eligible correlations missing. Exploitation requires an authenticated user (CVSS PR:L) who can edit at least one existing event and who touches one of those two fields; no public exploit code has been identified at time of analysis and no CISA KEV entry exists, so this is a genuine-but-low-priority access control defect rather than an actively exploited flaw.
Authenticated (site-admin) users on MISP installations prior to commit 2ebf29f93 can repoint the application's Redis host settings for the core app, ZeroMQ plugin, and SimpleBackgroundJobs plugin to an attacker-controlled Redis server, because those settings are exposed through the web UI and API instead of being restricted to CLI configuration. Combined with a separate session-hijack primitive such as stored XSS, an attacker can then restart the background workers, which trust raw Redis job payloads without validation, and inject malicious jobs that execute with the privileges of the worker account - effectively remote code execution. Exploitation requires a hijacked site-admin session and an attacker-operated Redis instance, so it is a conditional rather than drop-everything risk; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed CVSS:3.1 vector is AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.
Improper access control in MISP's attribute search and paginated attribute listing endpoints discloses soft-deleted (retracted) threat intelligence attributes belonging to other organizations to any authenticated user who already holds read visibility of the event, yielding a confidentiality-only impact rated CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Exploitation requires an authenticated MISP account (PR:L) and an explicit query for deleted attributes via the deleted-attributes search or the paginated attribute view with the deleted filter; the normal event detail view is not affected because it already restricts soft-deleted attributes to the owning organization and sync-permission users. All MISP versions prior to v2.5.48 are affected, the issue is rated a genuine but low-to-moderate priority information-disclosure problem rather than a critical emergency, no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV) exists, and practical relevance is highest on multi-organization, federated, or community instances where cross-organization event visibility exists.
Unauthorized disclosure of event metadata in MISP lets any authenticated user enumerate the titles, dates, and correlation counts of events they are not permitted to open. The related-events listing feature retrieved correlated events straight from the correlation table without re-checking the caller's access rights against each target event, and that table stores only a snapshot of distribution level and sharing group (with no published flag), so unpublished events and events whose distribution or sharing group changed after the correlation was recorded were still returned. Exploitation requires an authenticated account with access to at least one event plus pre-existing correlation entries crossing a sharing boundary, and it leaks metadata only - never attribute payloads; no public exploit was identified at time of analysis and the vendor has published a fix commit, making this a genuine but low-to-moderate priority exposure bounded to community members rather than anonymous internet attackers.
Cross-site scripting in MISP's remote event preview page allows a malicious or compromised linked MISP server to execute arbitrary JavaScript in an authenticated analyst's browser session. When a federated server link is configured and MISP.tagging is enabled, the tag element's inline onclick attribute embeds the event tag ID inside a JavaScript string literal using only HTML escaping, so a crafted tag ID containing a single quote breaks out of that literal and injects attacker-controlled script. The payload does not fire on page load - the victim must open the remote event preview and click the affected tag - and it is restricted to non-default federated deployments with a hostile peer, yielding a medium/low real-world priority; no public exploit code or confirmed active exploitation was identified at time of analysis, and the raw CVSS 4.0 base score is only 4.8 (MEDIUM).
Cross-site scripting (XSS) in MISP's TAXII object viewer (versions before 2.5.48) allows an attacker who can publish or influence TAXII objects to execute arbitrary JavaScript in the browser of an authenticated MISP user who views the crafted object. Exploitation requires the victim's MISP instance to subscribe to a malicious or compromised TAXII feed and the user to actively open the specific object, making it a targeted attack rather than opportunistic. No public exploit identified at time of analysis, but the vendor has released a patch in version 2.5.48.
Cross-site scripting in MISP’s ID Translator feature (before version 2.5.48) lets a malicious linked MISP server return a crafted event ID that executes arbitrary JavaScript in the browser of any authenticated user who views the ID Translator page, leading to session hijacking or credential theft. Exploitation requires a configured linked server, a compromised remote instance, and victim interaction (UI:R); it is unauthenticated from the attacker’s perspective (PR:N) but does not affect availability. No public exploit or active exploitation is identified, and the vendor has released a patch (commit bd5e80c84) that casts remote event IDs to integers and applies output encoding.
Stored cross-site scripting in MISP versions below 2.5.48 allows an attacker who can create or modify events on a linked (remote) MISP server to embed HTML or JavaScript in an event identifier, which is then rendered unescaped in the local instance's remote event preview index and executes in the browser session of any authenticated user who opens that page. The flaw is rated CVSS 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N; independent assessment CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), meaning the attacker must be authenticated on the remote server and the payload only fires once a victim navigates to the vulnerable preview view, so exploitation requires a fully pre-established trust chain rather than unauthenticated access. This is a moderate-severity stored XSS (CWE-79) with no signals of elevated real-world risk: there is no CISA KEV listing and no public exploit identified at time of analysis, and the vendor has released a fix.
Authenticated users on MISP instances before 2.5.48 can read restricted discussion thread titles and quoted post content, and can inject new posts into threads they are not authorized to participate in, because PostsController::add validated only the thread's organization-only distribution flag instead of the full thread access control list (sharing-group membership and associated event visibility). Exploitation requires a valid MISP account (the CVSS vector shows PR:L, so it is not exploitable unauthenticated) plus knowledge or enumeration of a target thread ID, but no user interaction. No public exploit code has been identified at the time of analysis, and the impact is confined to confidentiality and integrity of discussion content, making this a genuine but modest-severity authorization flaw rather than a critical one.
Reflected cross-site scripting in the MISP threat-intelligence platform allows an authenticated attacker to inject arbitrary JavaScript into the analyst data notes panel by supplying a crafted value in the 'seed' URL path parameter, which the application reflects unsanitized into inline JavaScript in the rendered page. The victim must already be logged into MISP and be persuaded to open the malicious link (for example via phishing), so exploitation depends on user interaction and prior authentication; impact is confined to the victim's browser session (session token or page-data theft, interface manipulation) rather than the server. The issue affects MISP builds prior to commit 58925dbf0 (post v2.5.48), where the parameter is forcibly cast to an integer; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor assessment rates overall risk as low.
Reflected cross-site scripting in MISP before 2.5.48 lets an attacker execute arbitrary JavaScript in an authenticated site administrator's browser by luring that admin to a crafted URL whose taxonomy tag name parameter is echoed unescaped into the legacy add_tag and disable_tag confirmation views. Exploitation requires no credentials or prior access to the instance (PR:N), but it cannot be self-triggered: the payload only fires in the victim admin's session after active user interaction with a malicious link (UI:A), so convincing phishing is the decisive limiting factor. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the vendor has released a patch (fixed in 2.5.48, commit 9619083c8), making this a genuine but low-to-moderate priority issue rather than an exploitable-at-scale flaw.
Stored cross-site scripting in MISP (all versions before 2.5.48) lets an authenticated account holding the perm_galaxy_editor permission - granted to the stock User role, so any ordinary user on a multi-user instance qualifies - persist arbitrary HTML or JavaScript in a galaxy's icon field via the galaxy add, edit, and sync/import capture endpoints. The stored value is later concatenated into markup by the D3-based correlation graph scripts of both the default and Overmind themes and inserted with jQuery's .html(), so any other user who opens the correlation graph of an event containing a cluster from the poisoned galaxy executes the attacker's script in their own MISP session, exposing session credentials and allowing actions or displayed-data tampering as that victim. Because exploitation requires editor privileges plus victim interaction (CVSS 4.0 6.2; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), this is a genuine but moderate-risk stored XSS, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.
Stored cross-site scripting in MISP before 2.5.48 allows an authenticated user with galaxy editor privileges to persist a javascript: URI in a Galaxy Cluster's 'source' field, which the application then renders as a clickable hyperlink; when a victim views the affected cluster and clicks the link, embedded script executes in the victim's browser context, enabling session hijacking, data exfiltration, or unauthorized actions as the victim. The sync path is the key risk amplifier: because Galaxy Clusters propagate between federated MISP instances, an editor on any instance that synchronizes to the target can plant the payload, so the attack surface extends beyond a single local deployment. Exploitation requires both authenticated galaxy editor access (PR:L) and active victim interaction (the victim must click the rendered link, not merely load the page), and no public exploit code was identified at time of analysis; the vendor has released a fix in 2.5.48.
Command injection in MISP misp-modules' cisco_firesight_manager_ACL_rule_export can cause arbitrary shell commands to be embedded in generated .sh export scripts when an authenticated MISP user with event/attribute submission privileges supplies values containing a single quote, such as a crafted ip-dst or url; an analyst who executes the script unmodified runs those commands with their own privileges. The issue requires active user interaction, does not directly compromise the MISP server, but can expose Cisco fireSIGHT Manager credentials, alter ACL rules, or compromise the analyst workstation, with a secondary NameError denial-of-service when the request lacks a config key. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the independent assessment views this as a genuine but conditional risk, and the upstream patch commit 625b54908efbd6acc8343aa3370d401dd370e748 adds shlex.quote and initializes config.
MISP's pre-authentication TOTP login path can reveal that a disabled account is TOTP-enrolled because the database query omits User.disabled, causing the disabled-account check to evaluate as false and present a TOTP prompt instead of an immediate rejection. This affects unauthenticated remote attackers who can reach UsersController::login(), but no authenticated access is granted because the downstream identify() call re-validates and rejects the disabled account. The practical impact is negligible: a small login-response information leak and a PHP undefined-array-key warning; no public exploit was identified at time of analysis, and the independent assessment rates the issue as low confidentiality impact only.
An authorization-check weakness in the Malware Information Sharing Platform (MISP) can allow an authenticated, low-privileged user to reach the previewEventAttributes endpoint because a typo in ACLComponent.php registers the required permission as 'theming_enabled*' - with a trailing asterisk - a string that matches no valid permission identifier in the ACL system. The issue affects MISP instances that ship the affected ACLComponent.php revision (CPE cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*); the practical outcome depends on the ACL evaluator's behavior on an unmatched key, failing open (exposing event attribute data to users who should not see it) or failing closed (denying access to legitimate theming_enabled users). Rated CVSS 4.0 base 5.3 (and CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N in independent review), this is a low-to-moderate-risk authorization flaw rather than an emergency; no public exploit code was identified at time of analysis and no KEV listing or EPSS data was provided.
Authenticated MISP site administrators can abuse the organisation logo-upload handler (OrganisationsController::__uploadLogo) as a filesystem oracle, learning whether arbitrary server paths exist and, for image files, what image type is detected. The flaw affects versions prior to upstream fix commit 12eaadc9e and requires the highest privilege tier (site-admin), which is why it carries a moderate CVSS 4.0 score of 5.1 but low real-world risk. It exposes no file contents and provides no write, execution, or modification primitive, and no public exploit code has been identified at time of analysis.
Path traversal (CWE-22) in MISP's __statisticsOrgs handler in UsersController.php allows an authenticated user holding the privilege to create or rename an organisation (org-admin or site-admin, consistent with the vendor's PR:H) to embed directory traversal sequences in an organisation name and turn the resulting file_exists() call into a boolean oracle for arbitrary file existence on the server. Impact is limited to low-confidentiality information disclosure: no file contents are read, written, or executed, and the vulnerable code path is effectively dead in current MISP deployments because the hard-coded directory app/webroot/img/orgs no longer exists (org logos were relocated to files/img/orgs), so the check never fires. No public exploit code has been identified at time of analysis, there is no CISA KEV entry indicating confirmed active exploitation, and the vendor has published an upstream fix in commit a2f7cba6e.
Path traversal in the MISP OrgImgHelper (findOrgImage) lets an authenticated user who can create or import events craft an organisation name containing '../' sequences so that a filesystem path is built and tested with PHP's file_exists() outside the intended org-image directory. This yields an arbitrary file-existence oracle for any path the web process can read, plus read of files that end in .png or .svg whose resolved name is then rendered or served back to the requester. Exploitation requires an authenticated account with event create/import rights (PR:L) and is confidentiality-only and low impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published an upstream fix (commit e00986075).
Authenticated MISP users holding at least a sharing-group editor role can overwrite organization metadata that should be reserved for site administrators or accounts with sync permissions, because Organisation::captureOrg applies the $force branch without checking perm_site_admin or perm_sync. The result is an integrity-only issue: organization records and the sharing-group and blueprint configurations derived from them can be altered, but no data disclosure or service disruption is possible and the attacker must already have a valid account with elevated (SG editor) privileges on the instance. Vendor fix code exists in upstream commit f3ec974ee, and no public exploit identified at time of analysis.
MISP versions prior to commit 9a2a4acfe allow an authenticated user with the perm_add permission to probe arbitrary filesystem paths through the EventReport::uploadPicture method, leaking file existence and file type via distinct validation error responses. Exploitation requires a valid MISP account with event or attribute creation rights but not administrative access, and it cannot read file contents, write files, or execute code. This is a low-severity information disclosure issue; no public exploit was identified at time of analysis, and the vendor fix is available in commit 9a2a4acfe.
An authenticated user without the perm_add permission can modify suggestion content in MISP event reports via the replaceSuggestionInReport endpoint, due to an ACLComponent wildcard mapping error fixed in MISP 2.5.47. The flaw is limited to authenticated instances, causes only low integrity impact to shared threat-intelligence report data, and no public exploit identified at time of analysis; independent assessment rates it as a genuine but low-severity authorization flaw.
Information disclosure in MISP versions before 2.5.47 lets an authenticated user who holds at least read access to an event view the most recent report attached to that event even when the report's own distribution/ACL setting is more restrictive than the parent event's - or when the report has been soft-deleted. The Overmind event view automatically enriches an event with its latest attached report, and the enrichment query filtered only on the event ID, omitting the report ACL conditions and the deleted flag, so a legitimately authorized but not report-authorized user can read threat-intelligence content they should not see. Exploitation requires an authenticated MISP account with existing read access to the target event (CVSS PR:L), no user interaction beyond opening the Overmind view, and is meaningful only where a more-restricted or soft-deleted report actually exists; the issue is a low-severity confidentiality leak rather than an emergency, and no public exploit identified at time of analysis.
Stored cross-site scripting in MISP's admin email composition screen allows a high-privileged user who can modify the MISP.org organization name to inject JavaScript that executes for another authenticated user who later opens that admin email page. Exploitation requires both the privileged configuration change and victim interaction with the affected view, and no public exploit has been identified at time of analysis. A vendor fix is available via upstream commit, though a tagged release version is not independently confirmed.
Blind server-side request forgery in MISP allows unauthenticated remote attackers to coerce the MISP server into making outbound HTTPS requests to arbitrary internal or external targets by POSTing a crafted XML body containing a bare HTTPS URL to the unauthenticated cspReport endpoint. The flaw arises because PHP operator precedence in Xml::build()'s readFile guard (`readFile && http || https`) leaves the HTTPS locator fetch path ungated, and RequestHandlerComponent automatically decodes XML request bodies on write requests. Exploitation is constrained to blind SSRF with no response body returned to the attacker, so it primarily enables probing, timing-based reconnaissance, and triggering GET-style actions on reachable HTTPS services; no public exploit code was identified at time of analysis, and a vendor patch commit is available.
An authenticated access-control and input-validation weakness in MISP's EventsController.php allows any logged-in user with access to enrichment/analysis functionality to supply a module name that is not in the instance's enabled-modules list, causing queryEnrichment to silently proceed with default parameters (format='simplified', no module-specific configuration) instead of rejecting the request. Successful abuse does not grant code execution or alter data; the assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning confidentiality-only, low impact, with no scope change, so this is a low-severity issue rather than a high-priority emergency. No public exploit code has been identified, and the vendor has published an upstream fix via commit 7dfcc4d32, which should be applied to close the missing-validation gap.
Authenticated MISP users can bypass sharing-group authorization when creating collections by issuing a PUT request to the collections/add endpoint instead of the expected POST. Although the controller applies the sharing-group usability check only for POST, the underlying CRUDComponent::add() persists data on both verbs, letting a low-privileged account set distribution=4 and associate a collection with a sharing group it is not authorized to use. This is a low-severity authorization flaw (CWE-862) requiring a valid session and knowledge of the target sharing-group ID; no public exploit identified at time of analysis, and there is no CISA KEV listing. The vendor fix is available in upstream commit c20f5a836.
MISP installer scripts for Debian 12/13, Ubuntu 24.04, and RHEL 9.4 write all installation output - including the generated admin password, database passwords, GPG passphrase, and supervisor password - into /var/log/misp_install.log, which is created world-readable (typically 0644) under the system default umask, with a companion world-readable FIFO at /var/log/misp_install.log.pipe. Any local unprivileged user on the host can read these credentials, and because the log persists after installation, the exposure is durable rather than limited to the install window; a pre-existing symlink in /var/log could also have redirected the write to an arbitrary location since the file was not removed before creation. The flaw affects MISP versions below 2.5.47 and requires a local account on a machine where an administrator has run one of the affected installer scripts; no public exploit code was identified at time of analysis. A vendor patch is available via upstream commit d5d72ab38, which forces root-only 0600 permissions on both the log and the FIFO.
MISP's event REST search export confirmation form reflects a URL-supplied event ID list into a single-quoted JavaScript string without escaping single quotes, allowing arbitrary JavaScript execution in an authenticated victim's browser. The attacker needs no MISP account, but exploitation requires the victim to be logged in and to open a crafted URL; only unpatched builds using the Default or UiBeta theme are affected, while the Overmind theme's form already uses an escaped data attribute and is not vulnerable to this sink. No public exploit identified at time of analysis, and the impact is bounded to the victim's web session rather than the MISP server itself.
Reflected cross-site scripting in MISP before 2.5.47 lets an authenticated user craft a URL against the AnalystDataController::viewForObject (__hub) action whose parent object-type parameter is echoed unencoded into the Overmind theme's AnalystData thread element, so an authenticated victim who clicks the link has arbitrary JavaScript executed in their browser within the MISP origin. The attacker must hold a valid MISP account (CVSS PR:L) and the instance must be running the Overmind theme, while the victim must actively follow the crafted URL (UI:A); impact is scoped to the victim's session and page, not the server. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available in the 2.5.47 release line via commit 23b879073. This is a genuine but low-to-moderate priority issue given the authentication, theme, and user-interaction prerequisites.
MISP instances configured to force TOTP enrolment (Security.otp_required) could be used indefinitely by an authenticated user who never completed second-factor setup, because the enrolment guard in AppController::__verifyUser was enforced only for standard browser requests; AJAX/XHR calls, REST API requests, .json format URLs, restSearch queries and automation actions bypassed the check since those request shapes cannot follow the redirect to the TOTP page. The affected range is MISP versions below 2.5.48, and exploitation requires a valid authenticated session for an account that has not enrolled in TOTP and whose role lacks perm_skip_otp, with identities authenticated by API key explicitly exempt (logged_by_authkey). Assessed impact is high for confidentiality and integrity (CVSS 3.1 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), with no public exploit identified at time of analysis; risk is real but conditional on the non-default otp_required hardening setting, so patched builds should be applied on a normal, prioritized schedule rather than as an emergency.
Stored cross-site scripting in Sachertortephp (MISP's CakePHP-derived framework) lets an authenticated user who can control an attachment filename inject CR/LF or a double quote into the Content-Disposition header generated by CakeResponse::download(). A CR/LF causes PHP to drop the entire Content-Disposition header so the response body renders inline with its own Content-Type on the application origin, while a double quote permits injection of additional Content-Disposition parameters; the payload is stored via attribute downloads, proposal downloads, or restSearch exports and executes when another authenticated user views the affected page. No public exploit code has been identified at time of analysis; an upstream fix is available via vendor commits.
Improper authorization in MISP's correlation handling lets an authenticated user with at least read access to some events retrieve attribute values and event metadata from events they are no longer permitted to view, in deployments running MISP before v2.5.48. The leak occurs because correlation lookups are authorized against a point-in-time distribution snapshot stored on the correlation row, which carries no published flag, so the check diverges from the live event ACL once a correlated event is unpublished or moved to a different sharing group; the CVSS vector (PR:L) confirms the attacker must be authenticated, and no public exploit code has been identified at time of analysis. Impact is confined to confidentiality - read-only exposure bounded to those correlated events that were restricted after the correlation was created - making this a moderate-severity, measured-priority patch rather than an emergency.
Improper input validation in MISP's decaying model import endpoint allows an authenticated user with the perm_decaying permission to overwrite, re-own, or re-flag decaying models belonging to other organisations in MISP versions before 2.5.48. The import handler strips only the top-level id and uuid fields and pins org_id/default on the outer array before saving the record flat, so a nested 'DecayingModel' key can smuggle its own primary key, organisation identifier, and default flag past those guards, letting an attacker modify an existing model in place, reassign its organisation, or set it as the organisation default and thereby alter scoring behaviour for other users. This is a bounded authorization/mass-assignment flaw rather than an unauthenticated critical: successful exploitation requires network access to the instance plus an account holding perm_decaying (not granted to ordinary users by default), and there is no confidentiality or availability impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and an upstream fix commit (70e319e4b) exists.
Authorization bypass in MISP's event flattening feature lets an authenticated user who can view a community-distributed event retrieve attributes that belong to organisation-only objects (distribution level 0) or objects restricted to a specific sharing group they are not a member of. MISP versions below 2.5.48 drop the Object containment from the query when the flatten option is used and return those object attributes as top-level event attributes without re-applying the object's own distribution or sharing-group access check, resulting in unauthorized disclosure of sensitive threat intelligence. This is a genuine but access-gated information-disclosure flaw, not a high-urgency internet-wide threat: exploitation requires a valid authenticated account, an event the user's organisation can already see via community distribution, and that event containing at least one object whose distribution is more restrictive than the event itself; no public exploit identified at time of analysis.
MISP (Malware Information Sharing Platform) versions before v2.5.48 accept the same TOTP one-time code more than once, allowing a captured second-factor code to be replayed to open an additional authenticated session. The flaw is a CWE-294 capture-replay weakness: the login flow never recorded that a given TOTP time-step had already been consumed, so a code remained usable for its entire ~30-second validity window. Exploitation is conditional rather than drive-by - the targeted user must have TOTP enabled, the attacker must be able to observe or intercept the live code (network interception, shoulder surfing, or a compromised client) and in practice also hold the first-factor credentials, and the replay must land inside the same TOTP period; the vendor has released a fix in v2.5.48, and no public exploit code has been identified at time of analysis.
Second-factor authentication bypass in MISP versions before 2.5.48 lets an attacker who already holds a session past the password step and a copy of the HOTP paper-token list replay a previously consumed HOTP token, because the OTP check compared the submitted token against a counter cached in the user's session rather than the authoritative database counter; the stale cached value still matches the burned token, yielding a second successful login and rewinding the counter state. Exploitation is not anonymous: it requires an authenticated session (PR:L per the assessed vector, implying prior password compromise), HOTP paper-token 2FA explicitly enabled on the target account, and knowledge of at least one valid token value, per the assessed CVSS:3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (vendor CVSS 4.0 score 7.6, High). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in MISP 2.5.48 by commit f34aee2c7.
Stored cross-site scripting in MISP's event graph preview lets an authenticated user who can create or modify an event graph entry persist a malicious preview_img value that executes in the browser of a second user who opens the graph and triggers the preview popover. The stored value is concatenated directly into an img src attribute in app/webroot/js/event-graph.js, so a crafted string can break out of the attribute context and inject arbitrary JavaScript in the MISP origin, enabling session/cookie theft or actions performed as the victim; exploitation is bounded by the required prior authentication (PR:L) and mandatory victim interaction, and no public exploit code or confirmed active exploitation was identified at time of analysis. Only MISP instances running versions prior to fix commit 92c7ccc43, which landed after v2.5.48, are affected, making internet-exposed multi-user deployments the realistic risk surface.
Privilege escalation in MISP before 2.5.48 allows an authenticated user who holds the tag editor permission (perm_tag_editor) to smuggle sibling User and Organisation records into tag collection create or edit requests, which the affected controller then persists alongside the intended tag collection - letting the attacker create or modify accounts and escalate to site administrator. Exploitation requires network access to the instance and a delegated tag-editor role; no user interaction or administrative rights are needed, and the accompanying source fix (commit 96f735e7b) shipped in MISP 2.5.48. No public exploit code was identified at time of analysis, and instances that never delegate perm_tag_editor to non-administrative accounts are not exposed to an unprivileged external actor.
Cross-tenant record tampering in MISP (Malware Information Sharing Platform) versions before 2.5.48 lets any authenticated user holding the basic write role (perm_add) overwrite attribute values, re-parent objects into their own events, or soft-delete rows owned by other organizations and events they have no read access to. The root cause is that the CakePHP ORM's set() gives precedence to an attacker-supplied nested key matching the model alias, so MISP's sanitization (primary-key stripping, event_id/object_id pinning) is applied to the outer flat record while the ORM actually persists the inner attacker-controlled one; the independent assessment confirms this is a fully remote, low-complexity exploit (PR:L, no UI) with integrity-only impact that extends across tenants (SI:H), and no public exploit code or in-the-wild activity has been identified at time of analysis. A vendor fix is available via upstream commit 9485ae40d, with the affected range ending at MISP 2.5.48.
MISP before 2.5.48 lets an authenticated user holding the delegation permission (perm_delegate) retarget an existing event-delegation record to any event on the instance by injecting an 'id' or 'event_id' field into the delegation submission, because the controller authorizes only the event named in the URL but persists the entire caller-supplied record. The injected row grants the attacker's organisation read access to the targeted event and, if the target organisation accepts the delegation, transfers ownership of that event and deletes the original record - a confidentiality and integrity impact rated 8.7 (CVSS:4.0) and assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. Exploitation requires two concrete preconditions: an account with perm_delegate and the non-default, instance-wide MISP.delegation setting enabled; there is no public exploit identified at time of analysis, but a vendor fix is available in 2.5.48 (commit d1f5684f9).
Deserialization-based code execution is possible in MISP because PHP's phar stream wrapper is left registered in both the web entry point (app/webroot/index.php) and the console entry point (app/Console/cake.php), so any filesystem call on a caller-influenced path that resolves to a phar archive silently triggers an unserialize() of attacker-controlled metadata, or can reach executable code inside an uploaded phar under a relocated application root. The vendor's fix (commit 08fa755b6) simply unregisters the wrapper at startup, confirming that nothing in MISP, vendored CakePHP, or runtime libraries legitimately uses phar archives. Real-world risk is lower than the 7.7 CVSS 4.0 score suggests: the vector requires authentication (PR:L - a valid MISP account) and High attack complexity (AC:H), because no MISP/CakePHP/library code natively feeds a caller-influenced path into a phar-resolving operation, so a separate path-influence bug must be chained and no public exploit code has been identified at time of analysis.
Cross-site request forgery in MISP's AttributesController::editField allows an attacker to silently alter threat-intelligence data - an attribute's value, type, category, comment, distribution settings or related timestamps - in any MISP instance where a user is currently logged in, simply by luring that user to an attacker-controlled web page. All MISP builds before 2.5.47 are affected because the editField action had been placed in CakePHP's Security->unlockedActions list, which switched off the framework's forged-request and form-tampering protection; the attacker needs no MISP account of their own (the CVSS vector carries PR:N, i.e. unauthenticated from the attacker's perspective), but the forged request executes with the victim's session and is bounded by that victim's own edit permissions on the target attribute. Impact is integrity-only - no data disclosure or service disruption - rated 7.1 under both the vendor's CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P/VI:H) and the independently assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N); a vendor fix is available via commit dfbae33f9 and no public exploit code has been identified at time of analysis.
Server-side request forgery and arbitrary local file read in MISP before 2.5.47 allow an authenticated user holding permission to add or modify data to upload content through the MISP export/import file handler that the server treats as a file locator rather than an XML document, causing MISP to read local files off the server or issue outbound requests to internal-only services. Assessed CVSS 3.1 is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N (8.3 in the CNA's CVSS 4.0 vector), reflecting high confidentiality impact, scope change and no integrity or availability impact, with the blast radius on the SSRF branch bounded by what the MISP host can reach on the internal network. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; exploitation requires a valid MISP account with modify/add privileges (PR:L) and no victim interaction.
Arbitrary code execution in MISP (Malware Information Sharing Platform) before version 2.5.47 arises because the blocklist workflow module writes a user-supplied filename into the MISP export directory after applying only basename() path stripping and empty/dot checks, leaving the file extension unvalidated. An attacker holding the MISP site-administrator role - the only role permitted to invoke this workflow module (PR:H per the assessed vector) - can therefore place a file with an executable extension in that directory, and if the underlying web server is configured to interpret scripts there, the file executes with the web server user's privileges, compromising confidentiality, integrity and availability. This is a genuine CWE-434 unrestricted file upload, but exploitation is gated both by the high privilege requirement and by the non-default web server configuration that executes scripts from the export path; no public exploit identified at time of analysis, and the flaw is addressed by the vendor's extension allowlist fix in 2.5.47.
Privilege escalation in MISP before version 2.5.47 lets an authenticated holder of a read-only API key silently regain the complete permission set of the underlying user account. After authenticating with a view-only key, a single request to the updateLoginTime function causes MISP to re-login the session using the full account record, effectively discarding the API key's read-only restriction so the caller can perform write, delete, or administrative actions the key was meant to block. The flaw requires a valid read-only API key tied to an account that itself holds higher privileges, and escalation is bounded by those existing account permissions; no public exploit code has been identified at the time of analysis, and there is no KEV-listed active exploitation.
Cross-event EventReport disclosure and tampering in MISP versions before 2.5.47 lets an authenticated user who can submit module (enrichment) results reparent, read, or overwrite another event's report by supplying a forged 'id' field in the resolved module data. The root cause is an authorization bypass through a user-controlled key (CWE-639): the report loop in Event::processModuleResultsData did not unset the client-supplied 'id' before calling save(), so the CakePHP ORM updated an existing report row belonging to a different event instead of inserting a new one. Exploitation is gated by authentication and the module-result-submission privilege, and by knowledge of a valid target EventReport id; the independent assessment rates this a genuine but moderate authorization flaw rather than a mass-data-exposure issue, and no public exploit code was identified at time of analysis, though the vendor has published an upstream fix commit (4c1a03b20).
Stored cross-site scripting in the MISP Overmind theme allows an authenticated user with permission to create or rename an object, event, or server/feed identifier to inject markup that is later rendered as live HTML in another user's dashboard. When a victim opens the affected event General card or server/feed preview card, the donut-chart legend concatenates the stored name directly into an innerHTML string, executing attacker-supplied script in the MISP application origin and enabling session hijacking, data exfiltration, or actions performed as the victim. Our independent assessment rates this as a genuine but moderate-priority issue: exploitation requires the non-default Overmind theme to be active (PR:L, UI:P), impact scales with the victim's privilege level, and no public exploit was identified at time of analysis (EPSS 0.33%, 26th percentile; SSVC Exploitation: none, Automatable: no, Technical Impact: partial).
Remote code execution in MISP prior to 2.5.47 allows an authenticated attacker who can submit the platform's events/contact form to run arbitrary PHP as the MISP web user. By setting the contact form's 'person' field to a reserved CakePHP console switch such as '-app' and the adjacent 'message' field to a phar:// URI, the attacker redirects the background-job worker's application root into an attacker-controlled archive whose Config/core.php is then included - a deterministic, single-shot exploit requiring authenticated access to the submission endpoint (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, rated 8.7 under CVSS 4.0) and no timing or race condition. Exploitation status per available intelligence: no public exploit identified at time of analysis, EPSS is low at 0.50% (42nd percentile), and CISA SSVC records Exploitation: none, though the flaw is fully fixed only by upgrading to 2.5.47 and the impact of success is full server-side compromise of the web process.
MISP through 2.5.45 fails to enforce authorization checks when collection elements are created, allowing an authenticated user to persist a bare UUID referencing an Event or Galaxy Cluster they are not permitted to read. The collection view later resolves that UUID back into the underlying object, so collections become a handle on another organisation's private data — the patch notes this already caused org-only events to be disclosed in the beta collection view. Exploitation requires a valid MISP account and knowledge of the target UUID; no public exploit code or CISA KEV listing was identified at time of analysis, though the CVSS 4.0 vector (PR:L, VC:H) and EPSS-adjacent signals mark it as a meaningful confidentiality risk for shared threat-intel instances.
An authorization bypass in MISP through version 2.5.45 lets an authenticated user who can edit events assign an arbitrary sharing_group_id they are not authorized to use, because the authorization check only ran when the request explicitly supplied distribution = 4. If the caller omits the distribution field, MISP's field-recovery logic restores the event's stored distribution (4, for sharing-group events) and persists the unauthorized sharing group ID, silently re-scoping who can see that event and its threat-intelligence content. No public exploit code or active exploitation has been identified at time of analysis, but exploitation is a single crafted edit request, so the integrity impact (VI:H, CVSS 4.0 base 7.1) is significant for multi-tenant or community-sharing MISP instances.
Authentication bypass in MISP's optional LdapAuth and LinOTPAuth plugins (versions ≤2.5.45) lets a remote unauthenticated attacker log in as any user whose email they know, without a password. Because LdapAuthenticate and LinOTPAuthenticate reimplement CakePHP's FormAuthenticate but omit its _checkFields() non-empty-string guard, an empty/null password reaches ldap_bind() and - per RFC 4513 §5.1.2 - is treated as an unauthenticated bind that many directories accept as success; impersonation grants the victim's full privileges, potentially administrative. There is no public exploit identified at time of analysis, and SSVC lists exploitation as none, but the technical impact is rated total.
MISP's interactive CLI shell (≤2.5.45) enforces access control independently from the web application, creating at least six distinct authorization gaps that allow authenticated local users to retrieve sensitive credentials and bypass record-level ACLs. Feed HTTP authorization headers (Feed.headers), server synchronization authkeys, sharing-group memberships, and feed visibility restrictions are all enforced correctly in the web tier but not in the CLI, while the `use` command allows a user to establish an unauthorized record context without proving read rights. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the combination of plaintext credential disclosure and authorization bypass makes this a high-priority patch for any MISP deployment where non-site-admin personnel have shell access to the host.
Missing authorization in MISP's event template instantiation path allows authenticated users to write events into sharing groups they are not permitted to access, and to attach tags beyond their normal tagging permissions. Affected are all MISP deployments running version 2.5.45 and earlier. An attacker with a low-privilege account that can view a community-distributed template (distribution=1) may exploit the flaw to bypass `SharingGroup::canUse()` checks and additionally cause `local_only` tags to propagate globally through MISP's synchronization and export mechanisms, violating the isolation guarantees those tags exist to enforce.
Uncontrolled resource consumption in MISP ≤2.5.45 allows unauthenticated remote attackers to exhaust persistent storage by flooding the password-reset and related pre-authentication endpoints, each of which performs durable database writes before validating or throttling the caller. The `/users/forgot` endpoint accepted arbitrarily long, unvalidated email values and generated two write operations per request - an audit log entry and a queued background job - with no rate limit, enabling storage and job-queue exhaustion at modest request rates. The upstream fix (commit d75d899be, reported by CIRCL) adds a 1024-byte email length cap, format validation, a Redis-backed per-source flood filter with HTTP 429 responses, and a 15-minute API-access request cooldown; no public exploit or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in MISP ≤2.5.45 allows high-privileged users who configure threat intelligence feeds or TAXII discovery endpoints to cause MISP to make outbound HTTP requests to internal network resources and to exfiltrate configured feed authentication credentials to attacker-controlled hosts via unsanitized redirect following. A secondary incomplete SSRF defense in the TAXII discovery path failed to block IPv6 loopback (::1), hex-encoded addresses (0x7f000001), and multi-record DNS responses because it relied on gethostbyname() against a short literal blocklist. No public exploit code or active exploitation (CISA KEV) has been identified; patch commits are available upstream.
Missing authorization in MISP versions 2.5.45 and earlier exposes cryptographic signing key material - including raw key data, key type, and fingerprint - to any authenticated user on the platform, regardless of whether they are permitted to view the associated parent event. The CryptographicKeysController::view() handler fetched CryptographicKey records directly by supplied ID without resolving or authorizing the parent event, enabling cross-event key exfiltration within shared MISP instances. No public exploit has been identified at time of analysis; a patch is available in upstream commit 2edde619b.
Disk-exhaustion denial of service in MISP ≤2.5.45 is exploitable by any authenticated user, including read-only accounts, due to a wildcard ACL entry ('*') on the TemplatesController::uploadFile() endpoint. The handler writes uploaded content to app/tmp/files/ without verifying that the caller holds the perm_add or perm_template role, allowing repeated uploads to consume server disk space. The fix commit explicitly rules out escalation to RCE, stored XSS, or path traversal - impact is availability-only. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authorization bypass in MISP's UiBeta theme collection view exposes full event details - including identifiers, info fields, timestamps, creator organization, all event tags, and galaxy clusters - to authenticated users who lack ACL permissions to those events. The UiBeta theme's `view.ctp` template performed an independent secondary database query using only `Event.uuid IN (...)` without invoking `createEventConditions()`, the canonical per-user ACL enforcement method, even though `CollectionsController::view()` correctly filtered events via `Event::fetchSimpleEvents($user, ...)`. The flaw is compounded because `CollectionElementsController::add()` accepts arbitrary UUIDs from collection owners without validating the submitter's authorization against the referenced event, making collection elements an attacker-controlled input to an unfiltered query. No public exploit code has been identified at time of analysis and no CISA KEV listing exists.
Cross-site request forgery in MISP's sharing group quick-edit feature allows an unauthenticated attacker to manipulate threat intelligence sharing group membership by tricking a privileged MISP user into loading a crafted URL. The root cause is that HTTP method enforcement - which should have restricted the addOrg, removeOrg, addServer, and removeServer actions to POST-only - was commented out in the shared helper __initialiseSGQuickEdit(), leaving all four endpoints reachable via GET. Successful exploitation can silently add or remove organisations and servers from a sharing group, potentially exposing sensitive threat intelligence to unintended recipients or severing legitimate information-sharing relationships.
Incorrect authorization in MISP allows any authenticated user who is a member of an event-owning organization to delete individual attributes or perform bulk attribute deletion from that event, regardless of whether their assigned role carries `perm_modify` or `perm_modify_org` permissions. Three deletion controller actions in `AttributesController.php` - `delete()`, `deleteSelection()`, and `deleteSelected()` - relied only on organization membership checks inside `MispAttribute::deleteAttribute()` rather than on MISP's authoritative `ACL::canModifyEvent()` gate, which attribute editing operations correctly invoked. No public exploit has been identified, but the integrity impact is significant for any collaborative MISP deployment because deleted threat intelligence attributes cannot trivially be recovered.
Sharing Group authorization bypass in MISP allows an authenticated user with attribute or Galaxy Cluster creation permissions to associate objects with Sharing Groups they are not permitted to use. The flaw resides in AttributesController and GalaxyClustersController, where authorization checks against the Sharing Group were only invoked when the request explicitly set distribution == 4 - an attacker can craft a request containing sharing_group_id while omitting or manipulating the distribution parameter, causing the membership verification to be skipped entirely. Successful exploitation can silently breach organizational information-sharing boundaries, injecting data into restricted Sharing Groups and potentially distributing it to unauthorized member organizations. No public exploit has been identified at time of analysis.
Persistent denial of service in MISP's event template subsystem allows an authenticated user with event-template write permissions to store malformed JSON as a template definition by bypassing semantic validation. When any authenticated user subsequently loads the event template index - an endpoint accessible to all authenticated users - an unhandled exception in afterFind() causes HTTP 500 errors instance-wide until an administrator manually repairs the offending database row. The patch enforces strict array-only validation on save and adds exception handling on retrieval with graceful degradation to an empty definition.
Session fixation in MISP's optional CustomAuth flow lets an attacker who pre-plants a known session identifier silently inherit a victim's fully authenticated MISP session after the victim logs in, gaining all privileges of the victim's account including access to shared threat intelligence, event data, and administrative functions. The flaw is confined to deployments explicitly configured to use CustomAuth - standard authentication modes are unaffected. Vendor patch is available at commit e2eb2f058; no public exploit identified at time of analysis.
Unlimited OTP brute-force against MISP's email-based two-factor authentication allows an attacker holding valid primary credentials to bypass the second factor and fully compromise a target account. The email_otp() endpoint applied no rate limiting or lockout, and the OTP is scoped to the user rather than the login session - enabling multiple concurrent sessions to hammer the same valid OTP simultaneously. Patch available via commit 8658062ea; no public exploit identified at time of analysis.
CSRF in MISP's cullEmptyEvents endpoint allows a network attacker to trigger irreversible mass deletion of published empty events by causing an authenticated, privileged MISP user's browser to auto-request a crafted URL - for example via an embedded image tag. The endpoint accepted HTTP GET requests, which CakePHP's SecurityComponent does not CSRF-validate because GET requests carry no body, causing the framework's hasData check to return false and bypass token enforcement. The deletion is particularly destructive because it runs with skipBlocklist set, meaning purged events leave no blocklist entries to prevent or track subsequent re-synchronization; fix commits are available on GitHub, though the exact patched release version is not independently confirmed. No public exploit code is identified at time of analysis.
Improper TLS certificate validation in MISP's CurlClient class allows an adjacent-network attacker to perform man-in-the-middle attacks against outbound HTTPS connections made by the MISP instance, including threat intelligence synchronization. The PHP property `CurlClient::$verifyPeer` was left uninitialized, defaulting to null, which cURL interprets as falsy and therefore disables peer certificate verification. A successful attacker can observe authentication material and exchanged threat intelligence, and inject falsified data into MISP's responses from remote services. No public exploit has been identified; SSVC rates exploitation as none at time of analysis.
Authentication bypass in MISP's LDAP and LinOTP login components lets a remote unauthenticated attacker impersonate an existing directory user by submitting an empty password for a known account email. The custom LdapAuthenticate and LinOTPAuthenticate classes replaced CakePHP's FormAuthenticate but omitted its credential-validation guard, so empty or non-string values reached ldap_bind() (which succeeds against directories permitting unauthenticated binds) or a local password hash derived from an empty string. If the impersonated account is privileged, the attacker gains full access to threat-intelligence data and configuration. No public exploit identified at time of analysis; a vendor patch (commit 0ee058548) is available.
Denial-of-service in misp-stix allows remote attackers to terminate long-running MISP importer processes or exhaust host memory and CPU by submitting malformed or oversized STIX 1 or STIX 2 documents. Two distinct conditions combine: parsing failures invoked sys.exit(), which raises SystemExit - a BaseException subclass that bypasses standard except Exception handlers in callers - causing unconditional process termination instead of a recoverable error; and the library materialized full document content in memory before applying any size or validity checks, with processing costs of 2-7x the raw input size enabling resource exhaustion. No public exploit identified at time of analysis; upstream fix commits are available on GitHub.
Path traversal in the misp-stix Python library allows an attacker who can supply crafted STIX 2 content to escape the configured object-template directory during PyMISP template resolution, reading arbitrary files accessible to the conversion process and copying their contents into converted MISP objects. All MISP deployments performing STIX 2 import or MISP-to-STIX 2 export via misp-stix are affected, with the flaw carrying a CVSS 4.0 score of 8.8. No public exploit or CISA KEV listing exists at time of analysis, but the vulnerability's persistent re-triggering pathway - where a poisoned MISP event is later re-exported by a higher-privilege process - represents a privilege-escalation risk beyond what the base score alone reflects.
Cross-site request forgery in CTI-Transmute's administrative user deletion endpoint enables unauthenticated remote attackers to delete arbitrary user accounts by inducing an authenticated administrator to follow a crafted link. The /account/delete/<id> endpoint accepted HTTP GET requests for an irreversible state-modifying operation, allowing any web page or email to silently trigger deletions using the victim's active session. No public exploit has been identified at time of analysis, though the attack requires no attacker credentials and depends solely on social engineering a logged-in administrator.
Uncontrolled resource consumption in CTI-Transmute's unauthenticated /activity_timeline endpoint allows remote attackers to exhaust database, CPU, and memory resources by submitting arbitrarily large values for the `days` query parameter. All versions of the MISP project's CTI-Transmute tool are affected until the upstream patch is applied; the fix clamps the parameter to a 1-1,095 day range. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 (VA:H, PR:N, AC:L) reflects that this is a trivially reachable denial-of-service with no authentication barrier.
Server-side request forgery in CTI-Transmute's evaluation report PDF-generation pipeline allows an attacker who can inject content into a CTI evaluation report to coerce the application server into fetching arbitrary internal or filesystem resources. The vulnerability arises because user-controlled fields - conversion names, descriptions, and comments - flow through a Markdown-to-HTML conversion and are then rendered to PDF by WeasyPrint with its default unrestricted URL-fetching behavior intact, meaning crafted file:// or http(s):// references embedded in that content are fetched by the server process at render time. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but a patch commit is available from the MISP project.
Open redirect in MISP installation scripts allows unauthenticated remote attackers to craft malicious URLs that leverage a missing trailing slash in the Apache HTTP-to-HTTPS redirect directive. When a user follows a crafted link on the legitimate MISP domain, the redirect appends attacker-controlled path content directly to the hostname, causing the browser to interpret the attacker’s domain as the destination host. This can lead to phishing and credential collection, though no active exploitation has been identified and a vendor patch is available.
Server-Side Request Forgery bypass in the html_to_markdown expansion module of misp-modules lets an authenticated attacker reach internal, loopback, and link-local services that the module's IP range filtering was meant to block. By supplying an IPv4-mapped IPv6 address such as http://[::ffff:169.254.169.254]/ (or a hostname resolving to one), the attacker defeats the blocked-range checks and can pull back internal content — including cloud instance metadata — rendered back to them as Markdown. No public exploit identified at time of analysis and it is not in CISA KEV, but the underlying IPv4-mapped-IPv6 filter bypass is a well-understood, easily reproduced technique.
Authenticated arbitrary code execution in MISP allows a site administrator to abuse the Kafka_rdkafka_config setting to load an attacker-controlled INI file, which is parsed and passed to rdkafka with options such as plugin.library.paths to load an arbitrary shared library. The flaw (CWE-829, inclusion of functionality from untrusted control sphere) yields code execution as the MISP process user; no public exploit identified at time of analysis, but a vendor patch is available.
Remote code execution in MISP allows authenticated site administrators to abuse the JsonLogTool NDJSON error log configuration to write attacker-controlled content to a PHP file under the webroot, yielding code execution as the web server user. No public exploit identified at time of analysis, but a vendor patch is available via the MISP GitHub repository.
Multiple OAuth 2.0 flow weaknesses in the MISP AAD (Azure Active Directory) authentication plugin allow session hijacking, session fixation, CSRF/replay against the OAuth callback, plaintext credential exposure over non-HTTPS redirect URIs, and log injection. The plugin reused the PHP session_id() as the OAuth state parameter, never rotated the session ID after login, did not enforce HTTPS on the redirect URI, and logged attacker-controlled GET parameters verbatim. No public exploit identified at time of analysis, but an upstream fix is available in MISP commit 146bc40.
Cross-organization data tampering in MISP (Malware Information Sharing Platform) core allows authenticated low-privileged users to modify or delete intelligence objects belonging to other organizations by exploiting broken access-control checks across Event Reports, Collection Elements, Analyst Data, Template Elements, and Decaying Models. The flaw stems from authorization being performed against the wrong entity ID or being entirely absent on write paths, enabling integrity attacks on shared threat intelligence. Vendor patches are available via multiple MISP GitHub commits; no public exploit identified at time of analysis.
Broken access control in MISP Core's bulk deletion handlers lets any authenticated user holding the broad perm_add or perm_sharing_group role flag hard-delete Event Reports and Sharing Groups belonging to other organisations across the entire instance. The flaw affects MISP threat-intelligence platform deployments and enables cross-tenant data destruction by contributor-level accounts; no public exploit identified at time of analysis, but the upstream patch commits are public and trivially reverse-engineerable.
Insecure direct object reference flaws in MISP threat-intelligence platform allow an authenticated user with access to any one authorized object to overwrite, re-parent, or transfer ownership of objects belonging to other users or organizations by submitting crafted REST/form payloads containing attacker-chosen primary keys and ownership foreign keys. The root cause is CRUDComponent::edit() mass-assigning payload-supplied IDs (id, event_id, org_id, user_id, sharing_group_id, etc.) onto the already-loaded record, so CakePHP's save() updates a different row than the one the authorization check validated. No public exploit identified at time of analysis, but a vendor patch is available and the high CVSS 4.0 score of 9.4 reflects broad cross-tenant impact.
Privilege escalation in MISP threat intelligence platform versions through 2.5.38 allows authenticated users to modify other users' account attributes by submitting a crafted User.id parameter in edit requests. The UsersController::edit() function failed to strip user-supplied identifiers before processing, enabling cross-account modifications. No public exploit identified at time of analysis, but the source code fix is publicly visible in the upstream commit.
Authorization bypass in MISP versions through 2.5.38 lets authenticated users delete records via HTTP DELETE requests even after the application's delete-validation callback has rejected the operation. The root cause is an operator-precedence bug in the CRUDComponent::delete() handler where missing parentheses caused validation checks to be skipped for the DELETE method. No public exploit identified at time of analysis, but the upstream fix commit on GitHub publicly discloses the exact one-line vulnerable expression, making weaponization trivial.
OTP authentication bypass in MISP affects deployments where LdapAuth.mixedAuth=true is combined with Security.require_otp=true, allowing attackers with valid LDAP (or other plugin) credentials to skip the mandatory second factor. Because the plugin-driven login establishes the session during the AppController beforeFilter phase, an attacker can authenticate, ignore the /users/otp challenge page, and browse directly to any authorized application URL as the victim. No public exploit identified at time of analysis, though the upstream commit clearly documents the bypass technique.
Insecure Direct Object Reference in MISP 2.5.0 through 2.5.37 allows authenticated users with shadow attribute submission privileges to overwrite arbitrary existing ShadowAttribute records by supplying a target id within the add proposal request. The framework's ORM interprets a client-supplied primary key as an update directive, breaking the boundary between proposal creation and modification. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Privilege escalation in MISP threat intelligence platform versions prior to 2.5.37 allows organization administrators to reset authentication keys of site administrator accounts within the same organization, yielding cross-tier access takeover. The flaw stems from missing authorization checks in the auth key reset workflow, enabling an org-admin to harvest a freshly generated site-admin API key. No public exploit identified at time of analysis, and EPSS rates exploitation probability at just 0.06%, but a vendor-released patch (2.5.37) is available.
SQL injection in MISP threat intelligence platform versions prior to 2.5.37 allows remote unauthenticated attackers to manipulate ORDER BY clauses in event and shadow attribute listing endpoints by supplying crafted ordering parameters. The CVSS 4.0 score of 9.3 reflects high impact across confidentiality, integrity, and availability, though EPSS exploitation probability sits at just 0.04% and no public exploit identified at time of analysis. Given MISP's role as a repository of sensitive threat-intelligence data shared between organizations, successful exploitation could expose IOCs, attribution data, and partner-shared intelligence.
LDAP injection in MISP (Malware Information Sharing Platform) versions prior to 2.5.36 enables unauthenticated attackers to bypass authentication and execute unauthorized LDAP queries. The vulnerability exists in ApacheAuthenticate.php when administrators configure apacheEnv to use user-controlled server variables instead of REMOTE_USER in proxy deployments. Attackers manipulate unsanitized username values to inject special characters into LDAP search filters, potentially gaining unauthorized access to the threat intelligence platform. No public exploit identified at time of analysis.
Silent threat-intelligence data loss occurs in MISP deployments that federate objects: when a user with object-creation privileges saves a MISP Object with an empty description, the originating instance accepts it, but the receiving instance during synchronization rejects it and silently drops the object together with all of its associated attributes. The flaw affects versions below 2.5.48 and requires an authenticated object creator (CVSS 4.0 PR:L) in a multi-instance sync topology, so it is a low-urgency data-integrity defect rather than an externally exploitable breach; no public exploit identified at time of analysis, and the root cause is fixed upstream by the validation change in MISP commit 6b1776f07.
Concurrent HTTP POST requests to MISP's email OTP login endpoint can both authenticate using the same one-time password, breaking the single-use guarantee and establishing duplicate sessions. Affected versions before 2.5.48 are vulnerable when email OTP login is enabled; exploitation requires the attacker to already hold a valid, unexpired OTP (via interception or social engineering) and to time two requests within the narrow race window. No public exploit code or active exploitation has been identified, and the independent assessment rates this as a genuine but low-urgency integrity issue (CVSS 3.1 base 3.6, high attack complexity) because success merely duplicates a session the OTP already granted.
MISP installations prior to 2.5.48 fail to refresh event correlations after an authenticated user with write access changes an event's distribution level or sharing group, because the before-save hook recorded the incoming (new) values instead of the already-persisted ones and the subsequent after-save comparison therefore found no change to act on. The practical effect is unintended information disclosure: correlations computed under a broader sharing scope can remain visible to members of the previously wider group even after the event has been moved into a more restrictive one, while distribution widening can conversely leave newly eligible correlations missing. Exploitation requires an authenticated user (CVSS PR:L) who can edit at least one existing event and who touches one of those two fields; no public exploit code has been identified at time of analysis and no CISA KEV entry exists, so this is a genuine-but-low-priority access control defect rather than an actively exploited flaw.
Authenticated (site-admin) users on MISP installations prior to commit 2ebf29f93 can repoint the application's Redis host settings for the core app, ZeroMQ plugin, and SimpleBackgroundJobs plugin to an attacker-controlled Redis server, because those settings are exposed through the web UI and API instead of being restricted to CLI configuration. Combined with a separate session-hijack primitive such as stored XSS, an attacker can then restart the background workers, which trust raw Redis job payloads without validation, and inject malicious jobs that execute with the privileges of the worker account - effectively remote code execution. Exploitation requires a hijacked site-admin session and an attacker-operated Redis instance, so it is a conditional rather than drop-everything risk; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed CVSS:3.1 vector is AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.
Improper access control in MISP's attribute search and paginated attribute listing endpoints discloses soft-deleted (retracted) threat intelligence attributes belonging to other organizations to any authenticated user who already holds read visibility of the event, yielding a confidentiality-only impact rated CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Exploitation requires an authenticated MISP account (PR:L) and an explicit query for deleted attributes via the deleted-attributes search or the paginated attribute view with the deleted filter; the normal event detail view is not affected because it already restricts soft-deleted attributes to the owning organization and sync-permission users. All MISP versions prior to v2.5.48 are affected, the issue is rated a genuine but low-to-moderate priority information-disclosure problem rather than a critical emergency, no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV) exists, and practical relevance is highest on multi-organization, federated, or community instances where cross-organization event visibility exists.
Unauthorized disclosure of event metadata in MISP lets any authenticated user enumerate the titles, dates, and correlation counts of events they are not permitted to open. The related-events listing feature retrieved correlated events straight from the correlation table without re-checking the caller's access rights against each target event, and that table stores only a snapshot of distribution level and sharing group (with no published flag), so unpublished events and events whose distribution or sharing group changed after the correlation was recorded were still returned. Exploitation requires an authenticated account with access to at least one event plus pre-existing correlation entries crossing a sharing boundary, and it leaks metadata only - never attribute payloads; no public exploit was identified at time of analysis and the vendor has published a fix commit, making this a genuine but low-to-moderate priority exposure bounded to community members rather than anonymous internet attackers.
Cross-site scripting in MISP's remote event preview page allows a malicious or compromised linked MISP server to execute arbitrary JavaScript in an authenticated analyst's browser session. When a federated server link is configured and MISP.tagging is enabled, the tag element's inline onclick attribute embeds the event tag ID inside a JavaScript string literal using only HTML escaping, so a crafted tag ID containing a single quote breaks out of that literal and injects attacker-controlled script. The payload does not fire on page load - the victim must open the remote event preview and click the affected tag - and it is restricted to non-default federated deployments with a hostile peer, yielding a medium/low real-world priority; no public exploit code or confirmed active exploitation was identified at time of analysis, and the raw CVSS 4.0 base score is only 4.8 (MEDIUM).
Cross-site scripting (XSS) in MISP's TAXII object viewer (versions before 2.5.48) allows an attacker who can publish or influence TAXII objects to execute arbitrary JavaScript in the browser of an authenticated MISP user who views the crafted object. Exploitation requires the victim's MISP instance to subscribe to a malicious or compromised TAXII feed and the user to actively open the specific object, making it a targeted attack rather than opportunistic. No public exploit identified at time of analysis, but the vendor has released a patch in version 2.5.48.
Cross-site scripting in MISP’s ID Translator feature (before version 2.5.48) lets a malicious linked MISP server return a crafted event ID that executes arbitrary JavaScript in the browser of any authenticated user who views the ID Translator page, leading to session hijacking or credential theft. Exploitation requires a configured linked server, a compromised remote instance, and victim interaction (UI:R); it is unauthenticated from the attacker’s perspective (PR:N) but does not affect availability. No public exploit or active exploitation is identified, and the vendor has released a patch (commit bd5e80c84) that casts remote event IDs to integers and applies output encoding.
Stored cross-site scripting in MISP versions below 2.5.48 allows an attacker who can create or modify events on a linked (remote) MISP server to embed HTML or JavaScript in an event identifier, which is then rendered unescaped in the local instance's remote event preview index and executes in the browser session of any authenticated user who opens that page. The flaw is rated CVSS 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N; independent assessment CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), meaning the attacker must be authenticated on the remote server and the payload only fires once a victim navigates to the vulnerable preview view, so exploitation requires a fully pre-established trust chain rather than unauthenticated access. This is a moderate-severity stored XSS (CWE-79) with no signals of elevated real-world risk: there is no CISA KEV listing and no public exploit identified at time of analysis, and the vendor has released a fix.
Authenticated users on MISP instances before 2.5.48 can read restricted discussion thread titles and quoted post content, and can inject new posts into threads they are not authorized to participate in, because PostsController::add validated only the thread's organization-only distribution flag instead of the full thread access control list (sharing-group membership and associated event visibility). Exploitation requires a valid MISP account (the CVSS vector shows PR:L, so it is not exploitable unauthenticated) plus knowledge or enumeration of a target thread ID, but no user interaction. No public exploit code has been identified at the time of analysis, and the impact is confined to confidentiality and integrity of discussion content, making this a genuine but modest-severity authorization flaw rather than a critical one.
Reflected cross-site scripting in the MISP threat-intelligence platform allows an authenticated attacker to inject arbitrary JavaScript into the analyst data notes panel by supplying a crafted value in the 'seed' URL path parameter, which the application reflects unsanitized into inline JavaScript in the rendered page. The victim must already be logged into MISP and be persuaded to open the malicious link (for example via phishing), so exploitation depends on user interaction and prior authentication; impact is confined to the victim's browser session (session token or page-data theft, interface manipulation) rather than the server. The issue affects MISP builds prior to commit 58925dbf0 (post v2.5.48), where the parameter is forcibly cast to an integer; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor assessment rates overall risk as low.
Reflected cross-site scripting in MISP before 2.5.48 lets an attacker execute arbitrary JavaScript in an authenticated site administrator's browser by luring that admin to a crafted URL whose taxonomy tag name parameter is echoed unescaped into the legacy add_tag and disable_tag confirmation views. Exploitation requires no credentials or prior access to the instance (PR:N), but it cannot be self-triggered: the payload only fires in the victim admin's session after active user interaction with a malicious link (UI:A), so convincing phishing is the decisive limiting factor. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the vendor has released a patch (fixed in 2.5.48, commit 9619083c8), making this a genuine but low-to-moderate priority issue rather than an exploitable-at-scale flaw.
Stored cross-site scripting in MISP (all versions before 2.5.48) lets an authenticated account holding the perm_galaxy_editor permission - granted to the stock User role, so any ordinary user on a multi-user instance qualifies - persist arbitrary HTML or JavaScript in a galaxy's icon field via the galaxy add, edit, and sync/import capture endpoints. The stored value is later concatenated into markup by the D3-based correlation graph scripts of both the default and Overmind themes and inserted with jQuery's .html(), so any other user who opens the correlation graph of an event containing a cluster from the poisoned galaxy executes the attacker's script in their own MISP session, exposing session credentials and allowing actions or displayed-data tampering as that victim. Because exploitation requires editor privileges plus victim interaction (CVSS 4.0 6.2; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), this is a genuine but moderate-risk stored XSS, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.
Stored cross-site scripting in MISP before 2.5.48 allows an authenticated user with galaxy editor privileges to persist a javascript: URI in a Galaxy Cluster's 'source' field, which the application then renders as a clickable hyperlink; when a victim views the affected cluster and clicks the link, embedded script executes in the victim's browser context, enabling session hijacking, data exfiltration, or unauthorized actions as the victim. The sync path is the key risk amplifier: because Galaxy Clusters propagate between federated MISP instances, an editor on any instance that synchronizes to the target can plant the payload, so the attack surface extends beyond a single local deployment. Exploitation requires both authenticated galaxy editor access (PR:L) and active victim interaction (the victim must click the rendered link, not merely load the page), and no public exploit code was identified at time of analysis; the vendor has released a fix in 2.5.48.
Command injection in MISP misp-modules' cisco_firesight_manager_ACL_rule_export can cause arbitrary shell commands to be embedded in generated .sh export scripts when an authenticated MISP user with event/attribute submission privileges supplies values containing a single quote, such as a crafted ip-dst or url; an analyst who executes the script unmodified runs those commands with their own privileges. The issue requires active user interaction, does not directly compromise the MISP server, but can expose Cisco fireSIGHT Manager credentials, alter ACL rules, or compromise the analyst workstation, with a secondary NameError denial-of-service when the request lacks a config key. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the independent assessment views this as a genuine but conditional risk, and the upstream patch commit 625b54908efbd6acc8343aa3370d401dd370e748 adds shlex.quote and initializes config.
MISP's pre-authentication TOTP login path can reveal that a disabled account is TOTP-enrolled because the database query omits User.disabled, causing the disabled-account check to evaluate as false and present a TOTP prompt instead of an immediate rejection. This affects unauthenticated remote attackers who can reach UsersController::login(), but no authenticated access is granted because the downstream identify() call re-validates and rejects the disabled account. The practical impact is negligible: a small login-response information leak and a PHP undefined-array-key warning; no public exploit was identified at time of analysis, and the independent assessment rates the issue as low confidentiality impact only.
An authorization-check weakness in the Malware Information Sharing Platform (MISP) can allow an authenticated, low-privileged user to reach the previewEventAttributes endpoint because a typo in ACLComponent.php registers the required permission as 'theming_enabled*' - with a trailing asterisk - a string that matches no valid permission identifier in the ACL system. The issue affects MISP instances that ship the affected ACLComponent.php revision (CPE cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*); the practical outcome depends on the ACL evaluator's behavior on an unmatched key, failing open (exposing event attribute data to users who should not see it) or failing closed (denying access to legitimate theming_enabled users). Rated CVSS 4.0 base 5.3 (and CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N in independent review), this is a low-to-moderate-risk authorization flaw rather than an emergency; no public exploit code was identified at time of analysis and no KEV listing or EPSS data was provided.
Authenticated MISP site administrators can abuse the organisation logo-upload handler (OrganisationsController::__uploadLogo) as a filesystem oracle, learning whether arbitrary server paths exist and, for image files, what image type is detected. The flaw affects versions prior to upstream fix commit 12eaadc9e and requires the highest privilege tier (site-admin), which is why it carries a moderate CVSS 4.0 score of 5.1 but low real-world risk. It exposes no file contents and provides no write, execution, or modification primitive, and no public exploit code has been identified at time of analysis.
Path traversal (CWE-22) in MISP's __statisticsOrgs handler in UsersController.php allows an authenticated user holding the privilege to create or rename an organisation (org-admin or site-admin, consistent with the vendor's PR:H) to embed directory traversal sequences in an organisation name and turn the resulting file_exists() call into a boolean oracle for arbitrary file existence on the server. Impact is limited to low-confidentiality information disclosure: no file contents are read, written, or executed, and the vulnerable code path is effectively dead in current MISP deployments because the hard-coded directory app/webroot/img/orgs no longer exists (org logos were relocated to files/img/orgs), so the check never fires. No public exploit code has been identified at time of analysis, there is no CISA KEV entry indicating confirmed active exploitation, and the vendor has published an upstream fix in commit a2f7cba6e.
Path traversal in the MISP OrgImgHelper (findOrgImage) lets an authenticated user who can create or import events craft an organisation name containing '../' sequences so that a filesystem path is built and tested with PHP's file_exists() outside the intended org-image directory. This yields an arbitrary file-existence oracle for any path the web process can read, plus read of files that end in .png or .svg whose resolved name is then rendered or served back to the requester. Exploitation requires an authenticated account with event create/import rights (PR:L) and is confidentiality-only and low impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published an upstream fix (commit e00986075).
Authenticated MISP users holding at least a sharing-group editor role can overwrite organization metadata that should be reserved for site administrators or accounts with sync permissions, because Organisation::captureOrg applies the $force branch without checking perm_site_admin or perm_sync. The result is an integrity-only issue: organization records and the sharing-group and blueprint configurations derived from them can be altered, but no data disclosure or service disruption is possible and the attacker must already have a valid account with elevated (SG editor) privileges on the instance. Vendor fix code exists in upstream commit f3ec974ee, and no public exploit identified at time of analysis.
MISP versions prior to commit 9a2a4acfe allow an authenticated user with the perm_add permission to probe arbitrary filesystem paths through the EventReport::uploadPicture method, leaking file existence and file type via distinct validation error responses. Exploitation requires a valid MISP account with event or attribute creation rights but not administrative access, and it cannot read file contents, write files, or execute code. This is a low-severity information disclosure issue; no public exploit was identified at time of analysis, and the vendor fix is available in commit 9a2a4acfe.
An authenticated user without the perm_add permission can modify suggestion content in MISP event reports via the replaceSuggestionInReport endpoint, due to an ACLComponent wildcard mapping error fixed in MISP 2.5.47. The flaw is limited to authenticated instances, causes only low integrity impact to shared threat-intelligence report data, and no public exploit identified at time of analysis; independent assessment rates it as a genuine but low-severity authorization flaw.
Information disclosure in MISP versions before 2.5.47 lets an authenticated user who holds at least read access to an event view the most recent report attached to that event even when the report's own distribution/ACL setting is more restrictive than the parent event's - or when the report has been soft-deleted. The Overmind event view automatically enriches an event with its latest attached report, and the enrichment query filtered only on the event ID, omitting the report ACL conditions and the deleted flag, so a legitimately authorized but not report-authorized user can read threat-intelligence content they should not see. Exploitation requires an authenticated MISP account with existing read access to the target event (CVSS PR:L), no user interaction beyond opening the Overmind view, and is meaningful only where a more-restricted or soft-deleted report actually exists; the issue is a low-severity confidentiality leak rather than an emergency, and no public exploit identified at time of analysis.
Stored cross-site scripting in MISP's admin email composition screen allows a high-privileged user who can modify the MISP.org organization name to inject JavaScript that executes for another authenticated user who later opens that admin email page. Exploitation requires both the privileged configuration change and victim interaction with the affected view, and no public exploit has been identified at time of analysis. A vendor fix is available via upstream commit, though a tagged release version is not independently confirmed.
Blind server-side request forgery in MISP allows unauthenticated remote attackers to coerce the MISP server into making outbound HTTPS requests to arbitrary internal or external targets by POSTing a crafted XML body containing a bare HTTPS URL to the unauthenticated cspReport endpoint. The flaw arises because PHP operator precedence in Xml::build()'s readFile guard (`readFile && http || https`) leaves the HTTPS locator fetch path ungated, and RequestHandlerComponent automatically decodes XML request bodies on write requests. Exploitation is constrained to blind SSRF with no response body returned to the attacker, so it primarily enables probing, timing-based reconnaissance, and triggering GET-style actions on reachable HTTPS services; no public exploit code was identified at time of analysis, and a vendor patch commit is available.
An authenticated access-control and input-validation weakness in MISP's EventsController.php allows any logged-in user with access to enrichment/analysis functionality to supply a module name that is not in the instance's enabled-modules list, causing queryEnrichment to silently proceed with default parameters (format='simplified', no module-specific configuration) instead of rejecting the request. Successful abuse does not grant code execution or alter data; the assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning confidentiality-only, low impact, with no scope change, so this is a low-severity issue rather than a high-priority emergency. No public exploit code has been identified, and the vendor has published an upstream fix via commit 7dfcc4d32, which should be applied to close the missing-validation gap.
Authenticated MISP users can bypass sharing-group authorization when creating collections by issuing a PUT request to the collections/add endpoint instead of the expected POST. Although the controller applies the sharing-group usability check only for POST, the underlying CRUDComponent::add() persists data on both verbs, letting a low-privileged account set distribution=4 and associate a collection with a sharing group it is not authorized to use. This is a low-severity authorization flaw (CWE-862) requiring a valid session and knowledge of the target sharing-group ID; no public exploit identified at time of analysis, and there is no CISA KEV listing. The vendor fix is available in upstream commit c20f5a836.
MISP installer scripts for Debian 12/13, Ubuntu 24.04, and RHEL 9.4 write all installation output - including the generated admin password, database passwords, GPG passphrase, and supervisor password - into /var/log/misp_install.log, which is created world-readable (typically 0644) under the system default umask, with a companion world-readable FIFO at /var/log/misp_install.log.pipe. Any local unprivileged user on the host can read these credentials, and because the log persists after installation, the exposure is durable rather than limited to the install window; a pre-existing symlink in /var/log could also have redirected the write to an arbitrary location since the file was not removed before creation. The flaw affects MISP versions below 2.5.47 and requires a local account on a machine where an administrator has run one of the affected installer scripts; no public exploit code was identified at time of analysis. A vendor patch is available via upstream commit d5d72ab38, which forces root-only 0600 permissions on both the log and the FIFO.
MISP's event REST search export confirmation form reflects a URL-supplied event ID list into a single-quoted JavaScript string without escaping single quotes, allowing arbitrary JavaScript execution in an authenticated victim's browser. The attacker needs no MISP account, but exploitation requires the victim to be logged in and to open a crafted URL; only unpatched builds using the Default or UiBeta theme are affected, while the Overmind theme's form already uses an escaped data attribute and is not vulnerable to this sink. No public exploit identified at time of analysis, and the impact is bounded to the victim's web session rather than the MISP server itself.
Reflected cross-site scripting in MISP before 2.5.47 lets an authenticated user craft a URL against the AnalystDataController::viewForObject (__hub) action whose parent object-type parameter is echoed unencoded into the Overmind theme's AnalystData thread element, so an authenticated victim who clicks the link has arbitrary JavaScript executed in their browser within the MISP origin. The attacker must hold a valid MISP account (CVSS PR:L) and the instance must be running the Overmind theme, while the victim must actively follow the crafted URL (UI:A); impact is scoped to the victim's session and page, not the server. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available in the 2.5.47 release line via commit 23b879073. This is a genuine but low-to-moderate priority issue given the authentication, theme, and user-interaction prerequisites.