CVE-2019-16202
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
MISP versions before 2.4.115 allow privilege escalation in certain situations. After updating to 2.4.115, escalation attempts are blocked by the __checkLoggedActions function.
Risk Assessment
Organizations using vulnerable versions of MISP may be exposed to unauthorized access to higher privileges, potentially leading to serious security breaches.
Recommendation
It is recommended to update MISP to version 2.4.115 or later to block privilege escalation attempts.
Original NVD description (English source)
MISP before 2.4.115 allows privilege escalation in certain situations. After updating to 2.4.115, escalation attempts are blocked by the __checkLoggedActions function with a "This could be an indication of an attempted privilege escalation on older vulnerable versions of MISP (<2.4.115)" message.