MISP vulnerabilities

An issue was discovered in MISP before version 2.4.121 that mishandled time skew between the web server and the database, potentially leading to ineffective protection against brute-force attacks.

In MISP 2.4.118 in app/Controller/TagsController.php, users can bypass intended restrictions on tagging data.

MISP versions before 2.4.115 allow privilege escalation in certain situations. After updating to 2.4.115, escalation attempts are blocked by the __checkLoggedActions function.

In MISP version 2.4.109, there is a vulnerability that allows remote command execution by a super administrator. The issue arises from the use of the PHP file_exists function with user-controlled entries, leading to deserialization via phar:// URLs.

An issue was discovered in MISP 2.4.108 that allows organization admins to reset passwords for site admins. This could lead to abuse when the host organization creates lower-privilege organization admins.

An issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107, allowing persistent XSS via link type attributes with javascript:// links.

In MISP version 2.4.102, an authenticated user can view sightings they should not be eligible for. Exploiting this requires access to the event that has received the sighting.

A vulnerability was discovered in MISP version 2.4.91 that allows reflected XSS. The issue is in app/View/Elements/eventattribute.ctp when a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter.

In MISP 2.4.87 in app/Controller/ServersController.php, a vulnerability allows the override of a path variable on certain Red Hat Enterprise Linux and CentOS systems where rh_shell_fix is enabled. This enables site admins to inject arbitrary OS commands.

The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, allowing admins to discover a hashed password by reading the audit log.