Vulnerabilities

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email).

Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed.

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: * object UUID; * object name; * attribute value; * attribute type; * comment; * first/last seen values; * IDS…

Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user.

Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API.

Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints.

Affected versions of Flowintel render calendar event titles using innerHTML.

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup.

Affected versions of Flowintel allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory.

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint.

Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into t…

FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields.

FlowIntel up to version 3.3.0 contains a server-side request forgery (SSRF) vulnerability in the external reference URL probe functionality in app/case/task.py.