CVE-2018-12649
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92 that allows an adversary to bypass brute-force protection. This can be done by using the PUT HTTP method instead of POST in the login part, as the protection only covered POST requests.
Risk Assessment
Bypassing brute-force protection increases the risk of unauthorized access to user accounts, potentially leading to serious security breaches.
Recommendation
It is recommended to update MISP to the latest version that fixes this vulnerability and to implement additional security measures to protect against brute-force attacks.
Original NVD description (English source)
An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method instead of a POST HTTP method in the login part, because this protection was only covering POST requests.