PT-2020-20353 · Misp · Misp

Dawid Czarnecki · Published 2020-02-11 · Updated 2020-02-14 · CVE-2020-8892

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.121

Description An issue was discovered where the software did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests. This issue affects the software's ability to prevent unauthorized access.

Recommendations For versions prior to 2.4.121, update to version 2.4.121 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTTP PUT method until a patch is available.

Fix

Related Identifiers

CVE-2020-8892

Affected Products

Misp

References · 6

• https://github.com/MISP/MISP/commit/c1a0b3b2809b21b4df8c1efbc803aff700e262c3 · Patch
• https://github.com/MISP/MISP/commit/934c82819237b4edf1da64587b72a87bec5dd520 · Patch
• https://github.com/MISP/MISP/compare/v2.4.120...v2.4.121 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-8892 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8892 · Vendor Advisory
• https://t.me/cvenotify/899 · Telegram Post