Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-48657: MISP 2.4.175 and earlier allows unauthorized data access

CVE-2023-48657 · published 2 years ago

Summary

MISP, a threat intelligence platform, has a security issue that could allow unauthorized users to view sensitive data. This is a concern because sensitive information could be exposed to the wrong people. We recommend updating to version 2.4.176 or later to fix this issue.

What to do

Update misp-project misp to version 2.4.176 or later.

Affected software

Vendor	Product	Affected versions
misp-project	misp	< 2.4.176 `cpe:2.3:a:misp-project:misp::::::::`

Original advisory text

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48657... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-48657 Vendor Advisory
https://github.com/MISP/MISP/compare/v2.4.175...v2.4.176 URL
https://zigrin.com/advisories/misp-time-based-sql-injection-in-logs-index/ Vendor Advisory
https://github.com/MISP/MISP/commit/08bd23281ead288de678de666ef43ed6de1899fc Patch

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Timeline

Published17 Nov 2023

Updated3 Nov 2026

First seen5 Aug 2026

Sources

CVE-2023-48657 · OSV

CVE-2023-48657 · NVD

Track software like this

Free during beta