PT-2021-19503 · Misp · Misp

Published 2021-04-23 · Updated 2021-05-05 · CVE-2021-31780

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MISP version 2.4.141

Description An issue in the MISP application could lead to information disclosure when editing an event. Specifically, when an object has a sharing group associated with an event edit, the sharing group object is ignored, and instead, the passed local ID is reused. This could result in unintended access to sensitive information.

Recommendations For MISP version 2.4.141, update to a version that addresses this issue to prevent information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-212

Related Identifiers

CVE-2021-31780

Affected Products

Misp

References · 4

• https://github.com/MISP/MISP/commit/a0f08501d2850025892e703f40fb1570c7995478 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-31780 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31780 · Vendor Advisory
• https://t.me/cvenotify/14115 · Telegram Post