PT-2019-12993 · Misp · Misp

Dawid Czarnecki · Publicado 2019-06-17 · Atualizado 2023-09-28 · CVE-2019-12868

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MISP version 2.4.109

Description The issue allows remote command execution by a super administrator due to the use of the PHP file exists function with user-controlled entries. Specifically, phar:// URLs can trigger deserialization, leading to the vulnerability.

Recommendations For MISP version 2.4.109, consider restricting access to the app/Model/Server.php file until a patch is available, and avoid using user-controlled entries with the file exists function to minimize the risk of exploitation.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2019-12868

Produtos afetados

Misp

Referências · 4

• https://github.com/MISP/MISP/commit/c42c5fe92783dd306b7600db1f6a25324445b40c · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2019-12868 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12868 · Aviso do Fabricante
• https://zigrin.com/advisories/misp-command-injection-via-phar-deserialization · Nota