Vulnerabilities

An authorization flaw in MISP’s object add/edit handling allowed an authenticated user with object editing permissions to assign a MISP object, or attributes contained within an object, to a sharing group that the user w…

A vulnerability in MISP’s non-REST event editing path allowed an authenticated user with event edit permissions to manipulate the submitted form data and set an event’s sharing_group_id to a sharing group they were not a…

An information disclosure vulnerability exists in the MISP AuthKey edit functionality.

MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view.

MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo.

A stored cross-site scripting vulnerability exists in MISP when the Overmind theme is used.

An incorrect visibility condition in the MISP event template builder allowed authenticated non-site-admin users to view galaxies that should not have been visible to their organisation.

MISP contained multiple mass assignment vulnerabilities in the handling of collections, tag collections, event delegations, and shadow attributes.

A mass assignment vulnerability exists in MISP’s sharing group creation endpoint.

MISP contains an insecure default configuration in which the Security.check_sec_fetch_site_header control is disabled.

An incorrect authorization vulnerability in MISP allows an organization administrator to target site administrator accounts belonging to the same organization through the administrative email functionality.

An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify user settings belonging to site administrator accounts within the same organization.