CVE Catalog
CVE-2017-16946
MediumCVSS 4.9Exploitation Probability (EPSS)
Elevated risk1.08%
61th percentile - higher than 61% of all known CVEs
Summary
The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, allowing admins to discover a hashed password by reading the audit log.
Risk Assessment
The organization may be exposed to the disclosure of sensitive information, potentially leading to unauthorized access to the system.
Recommendation
It is recommended to update MISP to the latest version to mitigate this vulnerability and review audit logs for potential incidents.
Original NVD description (English source)
The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, which allows admins to discover a hashed password by reading the audit log.