CVE-2024-25675

CriticalCVSS 9.8

Published: 09/02/2024(UTC)Updated: 22/06/2026(UTC)Translated: 23/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.82%

52th percentile - higher than 52% of all known CVEs

Summary

An issue was discovered in MISP before version 2.4.184, allowing a client to start an export generation process without needing to use POST. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp.

Risk Assessment

The lack of a requirement to use POST for initiating exports may lead to unauthorized access to data and potential information leakage.

Recommendation

It is recommended to update MISP to version 2.4.184 or later to mitigate this vulnerability.

Original NVD description (English source)

An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp.