PT-2018-17824 · Centos+2 · Centos+2

Grolinet + 1 · Publicado 2018-02-12 · Atualizado 2018-03-16 · CVE-2018-6926

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MISP version 2.4.87

Description A server setting in MISP permitted the override of a path variable on certain Red Hat Enterprise Linux and CentOS systems, allowing site administrators to inject arbitrary OS commands. The impact is limited as the setting is only accessible to site administrators.

Recommendations For MISP version 2.4.87, consider restricting access to the server setting to prevent arbitrary OS command injection until a patch is available. As a temporary workaround, site administrators should avoid using the vulnerable setting to override path variables on Red Hat Enterprise Linux and CentOS systems where rh shell fix is enabled.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-6926

Produtos afetados

Centos

Misp

Red Hat

Referências · 3

• https://github.com/MISP/MISP/commit/0a2aa9d52492d960b9a161160acedbe9caaa4126 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-6926 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-6926 · Aviso do Fabricante