CVE-2018-19908
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
An issue was discovered in MISP versions 2.4.9x before 2.4.99 related to improper handling of filenames in the STIX 1 import code. An unescaped filename string is used to construct a shell command, allowing a malicious authenticated user to execute arbitrary commands.
Risk Assessment
The organization may be exposed to unauthorized command execution in the system by malicious users, potentially leading to serious security breaches.
Recommendation
It is recommended to update MISP to version 2.4.99 or later to mitigate this vulnerability and implement additional security measures to restrict access to the import functionality.
Original NVD description (English source)
An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking the original filename of the STIX import.