CVE-2022-42724

MediumCVSS 4.3

Published: 10/10/2022(UTC)Updated: 23/06/2026(UTC)Translated: 24/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

35th percentile - higher than 35% of all known CVEs

Summary

In app/Controller/UsersController.php in MISP before version 2.4.164, there is a vulnerability that allows attackers to discover role names, which should only be accessible to the site administrator.

Risk Assessment

The discovery of role names may lead to further attacks on the system, as it exposes information that should be confidential.

Recommendation

It is recommended to update MISP to version 2.4.164 or later to mitigate this vulnerability.

Original NVD description (English source)

app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have).