CVE-2024-45509

MediumCVSS 6.5

Published: 01/09/2024(UTC)Updated: 22/06/2026(UTC)Translated: 23/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

31th percentile - higher than 31% of all known CVEs

Summary

In MISP versions up to 2.4.196, the app/Controller/BookmarksController.php file does not properly restrict access to bookmarks data when the user is not an org admin.

Risk Assessment

The lack of proper access restrictions may lead to the exposure of sensitive bookmarks data to other users, posing a risk to the organization's privacy and security.

Recommendation

It is recommended to update MISP to the latest version to ensure proper access restrictions to bookmarks data.

Original NVD description (English source)

In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin.