PT-2020-20351 · Misp · Misp

Dawid Czarnecki · Published 2020-02-11 · Updated 2020-02-14 · CVE-2020-8890

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.121

Description The issue arises from mishandling time skew between the machine hosting the web server and the machine hosting the database when attempting to block a series of invalid requests, potentially leading to brute-force attacks.

Recommendations For versions prior to 2.4.121, update to version 2.4.121 or later to resolve the issue.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2020-8890

Affected Products

Misp

References · 6

• https://github.com/MISP/MISP/commit/934c82819237b4edf1da64587b72a87bec5dd520 · Patch
• https://github.com/MISP/MISP/commit/c1a0b3b2809b21b4df8c1efbc803aff700e262c3 · Patch
• https://github.com/MISP/MISP/compare/v2.4.120...v2.4.121 · Patch
• https://osv.dev/vulnerability/CVE-2020-8890 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8890 · Security Note
• https://t.me/cvenotify/897 · Telegram Post