CVE-2022-48329

CriticalCVSS 9.8

Published: 20/02/2023(UTC)Updated: 22/06/2026(UTC)Translated: 23/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.93%

56th percentile - higher than 56% of all known CVEs

Summary

MISP before 2.4.166 unsafely allows users to use the 'order' parameter, which may lead to unauthorized access to data.

Risk Assessment

The organization may be exposed to attacks that exploit this vulnerability to manipulate data or gain access to sensitive information.

Recommendation

It is recommended to upgrade MISP to version 2.4.166 or later to mitigate this vulnerability.

Original NVD description (English source)

MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.