CVE-2021-27904
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139, where the implementation of Sharing Groups sometimes provided view access to unintended actors via the 'all org' flag.
Risk Assessment
The risk associated with this vulnerability is that unauthorized users may gain access to sensitive information, potentially leading to breaches of privacy and data security.
Recommendation
It is recommended to update MISP to the latest version to mitigate this vulnerability and to review sharing group settings to ensure appropriate access permissions.
Original NVD description (English source)
An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139. In the implementation of Sharing Groups, the "all org" flag sometimes provided view access to unintended actors.