CVE-2020-15411

CriticalCVSS 9.8

Published: 30/06/2020(UTC)Updated: 22/06/2026(UTC)Translated: 23/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.45%

70th percentile - higher than 70% of all known CVEs

Summary

An issue was discovered in MISP version 2.4.128 related to insufficient ACL checks in the attachment downloader in app/Controller/AttributesController.php.

Risk Assessment

Insufficient access controls may lead to unauthorized downloading of attachments, posing a risk of sensitive data leakage.

Recommendation

It is recommended to update MISP to the latest version to patch this vulnerability and review the ACL configuration.

Original NVD description (English source)

An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader.