CVE-2020-15412

MediumCVSS 4.3

Published: 30/06/2020(UTC)Updated: 22/06/2026(UTC)Translated: 23/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.68%

48th percentile - higher than 48% of all known CVEs

Summary

An issue was discovered in MISP version 2.4.128, where app/Controller/EventsController.php lacks an event ACL check before allowing a user to send an event contact form.

Risk Assessment

The lack of proper ACL checks may lead to unauthorized access to application features, posing a risk of abuse and data leakage.

Recommendation

It is recommended to update MISP to the latest version that includes fixes for ACL checks and to review the code to ensure proper security measures.

Original NVD description (English source)

An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form.