CVE-2021-39302

CriticalCVSS 9.8

Published: 19/08/2021(UTC)Updated: 22/06/2026(UTC)Translated: 23/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.94%

56th percentile - higher than 56% of all known CVEs

Summary

MISP version 2.4.148, in certain configurations, allows SQL injection via the $conditions['org'] value in the app/Model/Log.php file.

Risk Assessment

An attacker could exploit this vulnerability to execute unauthorized database queries, potentially leading to the disclosure of sensitive information or data manipulation.

Recommendation

It is recommended to update MISP to the latest version and review configurations to minimize the risk of SQL injection.

Original NVD description (English source)

MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value.