Vulnerabilities

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.

Affected versions of MISP use Redis to throttle repeated authentication-failure log entries.

Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception.

Affected versions of MISP expose several state-changing controller actions without restricting them to POST.

Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag.

Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object.

Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path.

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation.