MISP-Project MISP Project MISP (Malware Information Sharing Platform) any version

app/Controller/TemplatesController.php in Malware Information Sharing Platform (MISP) before 2.3.92 does not properly restrict filenames under the tmp/files/ directory, which has unspecified impact and attack vectors.

OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled

Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serialized data, related to TemplatesController.php and populate_event_from_template_attributes.ctp.

An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur.

In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call.

app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.

MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php.

MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.

An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters.

An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing.

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space.

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters.

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses.

MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials

An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp.

In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.

app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs.

An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type.

app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in the same org.

In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin.

In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.

LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable

MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints

MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings

MISP remote code execution via arbitrary rdkafka configuration path

MISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection

MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery

MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks

An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking the original filename of the STIX import.

In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.

An issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF.

Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models

In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.

MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request

Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP

MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding

MISP: Improper access control in auth key reset allows privilege escalation to site administrator

Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass

Unauthorized ShadowAttribute modification in MISP via client-supplied identifier

An issue was discovered in MISP before 2.4.121. It did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests.