PT-2023-19369 · Misp · Misp

Published 2023-01-20 · Updated 2023-01-27 · CVE-2023-24028

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MISP version 2.4.167

Description The issue concerns incorrect access control in the ACLComponent.php file for the decaying import function. This affects the app/Controller/Component/ACLComponent.php component.

Recommendations For MISP version 2.4.167, consider restricting access to the decaying import function until a patch is available. As a temporary workaround, review and adjust the access control settings in the ACLComponent.php file to ensure proper access control for the decaying import function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2023-24028

Affected Products

Misp

References · 6

• https://github.com/MISP/MISP/commit/93bf15d3bd703a32ebfe86cb6c1c9b735cf23e30 · Patch
• https://osv.dev/vulnerability/CVE-2023-24028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24028 · Security Note
• https://t.me/cvenotify/42957 · Telegram Post
• https://t.me/cibsecurity/56802 · Telegram Post
• https://t.me/cvenotify/42597 · Telegram Post