PT-2024-23086 · Misp · Misp

Raphael Lob + 1 · Published 2024-03-21 · Updated 2025-06-17 · CVE-2024-29858

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.187

Description The issue concerns a weak security check in the uploadLogo function within the OrganisationsController.php file. This function does not properly validate logo uploads.

Recommendations For versions prior to 2.4.187, update to version 2.4.187 or later to resolve the issue. As a temporary workaround, consider disabling the uploadLogo function in OrganisationsController.php until a patch is available. Restrict access to the logo upload feature to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-616

Related Identifiers

CVE-2024-29858

Affected Products

Misp

References · 5

• https://github.com/MISP/MISP/commit/6a2986be6aad6b37858b4869e238f517b295c111 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-29858 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29858 · Vendor Advisory
• https://twitter.com/RedPacketSec/status/1771479478264356886 · Twitter Post
• https://t.me/cvenotify/125922 · Telegram Post