CVE Catalog
CVE-2024-25674
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk0.77%
51th percentile - higher than 51% of all known CVEs
Summary
An issue was discovered in MISP before version 2.4.184 related to insecure organization logo uploads due to a lack of checks for file extension and MIME type.
Risk Assessment
The absence of proper checks may allow the upload of malicious files, posing a risk to the security of the system and the organization's data.
Recommendation
It is recommended to update MISP to version 2.4.184 or later and implement additional checks for uploaded files.
Original NVD description (English source)
An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type.