PT-2019-12993 · Misp · Misp

Dawid Czarnecki · Published 2019-06-17 · Updated 2023-09-28 · CVE-2019-12868

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MISP version 2.4.109

Description The issue allows remote command execution by a super administrator due to the use of the PHP file exists function with user-controlled entries. Specifically, phar:// URLs can trigger deserialization, leading to the vulnerability.

Recommendations For MISP version 2.4.109, consider restricting access to the app/Model/Server.php file until a patch is available, and avoid using user-controlled entries with the file exists function to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2019-12868

Affected Products

Misp

References · 4

• https://github.com/MISP/MISP/commit/c42c5fe92783dd306b7600db1f6a25324445b40c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-12868 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12868 · Vendor Advisory
• https://zigrin.com/advisories/misp-command-injection-via-phar-deserialization · Note