ByteOS Network

NVD Vulnerability Details :

CVE-2018-19908

Analyzed

Source-cve@mitre.org

Published At-06 Dec, 2018 | 16:29

Updated At-03 Oct, 2019 | 00:03

An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking the original filename of the STIX import.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	9.0	HIGH	AV:N/AC:L/Au:S/C:C/I:C/A:C

CPE Matches

misp>>misp>>Versions from 2.4.90(inclusive) to 2.4.99(exclusive)

cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-78	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/MISP/MISP/commit/211ac0737281b65e7da160f0aac52f401a94e1a3	cve@mitre.org	Patch Third Party Advisory
https://github.com/MISP/MISP/releases/tag/v2.4.99	cve@mitre.org	Release Notes Third Party Advisory
https://www.exploit-db.com/exploits/46401/	cve@mitre.org	Exploit Third Party Advisory VDB Entry

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History