4.9

CVE-2020-11458

Exploit
app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP. This does not cause a leak of the full contents of a file, but does cause a leaks of strings that match certain patterns. Among the data that can leak are passwords from database.php or GPG key passphrases from config.php.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Misp-project ≫ Misp Version < 2.4.124
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.11% 0.616
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.9 1.2 3.6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://github.com/MISP/MISP/commit/30ff4b6451549dae7b526d4fb3a49061311ed477
Patch
Third Party Advisory
https://matthias.sdfeu.org/misp-poc.py
Third Party Advisory
Exploit