PT-2020-16906 · Misp · Misp

Heitor Gouvêa · Published 2020-11-01 · Updated 2020-11-17 · CVE-2020-28043

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.134

Description The issue allows for Server-Side Request Forgery (SSRF) in the REST client. This is achieved via the use full path parameter with an arbitrary URL.

Recommendations For versions prior to 2.4.134, update to version 2.4.134 or later to resolve the issue. As a temporary workaround, consider restricting the use of the use full path parameter in the REST client until a patch is available.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2020-28043

Affected Products

Misp

References · 4

• https://github.com/MISP/MISP/commit/6e81c8ee8ad19576c055b5c4773f914b918f32be · Patch
• https://osv.dev/vulnerability/CVE-2020-28043 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28043 · Security Note
• https://t.me/cvenotify/5699 · Telegram Post