Vulnerabilities

Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting.

Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first checking whether the requester is authorized to view the object…

Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information.

Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget.

Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality.

Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view.

Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates().

Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view().

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /.

Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploadFile used the wildcard *.

Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality.

A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field.

MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow.

A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts.

A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP.

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration.

MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder.

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other acc…

MISP contains an improper TLS certificate validation vulnerability in CurlClient.

MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials.

MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path.

MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool.

The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to bypass important security guarantees provided by the protocol…

MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability checks were missing on write paths.

MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups.