PT-2020-14414 · Misp · Misp

Published 2020-06-30 · Updated 2021-07-21 · CVE-2020-15412

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MISP version 2.4.128

Description An issue was discovered in the EventsController.php file, specifically that it lacks an event ACL check before allowing a user to send an event contact form. This issue may potentially allow unauthorized access or actions.

Recommendations For MISP version 2.4.128, consider restricting access to the EventsController.php file or implementing an event ACL check to prevent unauthorized users from sending event contact forms. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-15412

Affected Products

Misp

References · 4

• https://github.com/MISP/MISP/commit/b0be3b07fee2ab9bf1869ef81a7f24f58bd687ef · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15412 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15412 · Vendor Advisory
• https://t.me/cvenotify/4740 · Telegram Post