CVE Catalog
CVE-2015-5719
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk2.27%
81th percentile - higher than 81% of all known CVEs
Summary
In MISP versions before 2.3.92, the file app/Controller/TemplatesController.php does not properly restrict filenames under the tmp/files/ directory, which may lead to unspecified impacts and attack vectors.
Risk Assessment
The lack of proper filename restrictions may allow attackers to manipulate data or gain access to sensitive information.
Recommendation
It is recommended to update MISP to version 2.3.92 or later to mitigate this vulnerability.
Original NVD description (English source)
app/Controller/TemplatesController.php in Malware Information Sharing Platform (MISP) before 2.3.92 does not properly restrict filenames under the tmp/files/ directory, which has unspecified impact and attack vectors.