PT-2021-17658 · Misp · Misp

Jeroen Pinoy · Published 2021-03-02 · Updated 2021-03-08 · CVE-2021-27904

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: MISP version 2.4.139

Description: An issue was discovered in the implementation of Sharing Groups, where the all org flag sometimes provided view access to unintended actors. This occurred due to a problem in the app/Model/SharingGroupServer.php file.

Recommendations: For MISP version 2.4.139, consider restricting access to the Sharing Groups feature until a patch is available. As a temporary workaround, review and adjust the all org flag settings to ensure they are correctly configured and not providing unintended access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2021-27904

Affected Products

Misp

References · 6

• https://github.com/MISP/MISP/commit/ca13fee271ad126832c88896776f3050a6c06e64 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-27904 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27904 · Vendor Advisory
• https://t.me/cvenotify/10696 · Telegram Post
• https://t.me/cvenotify/10986 · Telegram Post
• https://t.me/cibsecurity/24332 · Telegram Post