PT-2023-25897 · Misp · Misp

Hash_Kitten · Published 2023-06-30 · Updated 2023-07-07 · CVE-2023-37306

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MISP version 2.4.172

Description The issue arises from MISP's mishandling of different certificate file extensions during server sync, leading to sensitive information disclosure through error messages.

Recommendations For MISP version 2.4.172, update to a version that addresses this issue, as the current version mishandles certificate file extensions, potentially leading to sensitive information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2023-37306

Affected Products

Misp

References · 5

• 🔥 https://synacktiv.com/publications/php-filter-chains-file-read-from-error-based-oracle · Exploit
• https://github.com/MISP/MISP/commit/f125630c1c2d0f5d11079d3653ab7bb2ab5cd908 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-37306 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37306 · Vendor Advisory
• https://t.me/cibsecurity/65809 · Telegram Post