CVE-2021-25323

CriticalCVSS 9.1

Published: 19/01/2021(UTC)Updated: 22/06/2026(UTC)Translated: 23/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.31%

67th percentile - higher than 67% of all known CVEs

Summary

The default setting of MISP 2.4.136 did not require providing the previous password when changing a password, which may lead to unauthorized changes.

Risk Assessment

The lack of a requirement for previous password confirmation increases the risk of unauthorized access to user accounts, potentially leading to data breaches.

Recommendation

It is recommended to upgrade to a newer version of MISP that enforces the requirement to provide the previous password when changing passwords.

Original NVD description (English source)

The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password when changing a password.