PT-2020-13320 · Misp · Misp-Maltego

Published 2020-05-15 · Updated 2022-05-24 · CVE-2020-12889

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MISP MISP-maltego version 1.4.4

Description The issue arises from MISP MISP-maltego incorrectly sharing a MISP connection across users in a remote-transform use case. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For version 1.4.4, update to version 1.4.5, which contains a patch for this issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2020-12889

GHSA-FJ35-M94R-9H4C

PYSEC-2020-66

Affected Products

Misp-Maltego

References · 9

• https://github.com/MISP/MISP-maltego/commit/3ccde66dab4096ab5663e69f352992cc73e1160b · Patch
• https://osv.dev/vulnerability/PYSEC-2020-66 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fj35-m94r-9h4c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12889 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12889 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/misp-maltego/PYSEC-2020-66.yaml · Note
• https://github.com/MISP/MISP-maltego · Note
• https://t.me/cvenotify/3850 · Telegram Post
• https://github.com/advisories/GHSA-fj35-m94r-9h4c · Note