PT-2023-25897 · Misp · Misp

Hash_Kitten · Publicado 2023-06-30 · Atualizado 2023-07-07 · CVE-2023-37306

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MISP version 2.4.172

Description The issue arises from MISP's mishandling of different certificate file extensions during server sync, leading to sensitive information disclosure through error messages.

Recommendations For MISP version 2.4.172, update to a version that addresses this issue, as the current version mishandles certificate file extensions, potentially leading to sensitive information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Generation of Error Message Containing Sensitive Information

Enumeração de Fraquezas

CWE-209

Identificadores relacionados

CVE-2023-37306

Produtos afetados

Misp

Referências · 5

• 🔥 https://synacktiv.com/publications/php-filter-chains-file-read-from-error-based-oracle · Exploit
• https://github.com/MISP/MISP/commit/f125630c1c2d0f5d11079d3653ab7bb2ab5cd908 · Correção
• https://t.me/cibsecurity/65809 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-37306 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-37306 · Aviso do Fabricante