CVE-2017-14337: High severity misp vulnerability
When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate authentication and this API returns an empty value, the unauthenticated user can be granted access as an arbitrary user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14337?
CVE-2017-14337 is classified as a medium severity vulnerability due to its potential to allow unauthorized access.
How do I fix CVE-2017-14337?
To fix CVE-2017-14337, update MISP to version 2.4.80 or later.
What does CVE-2017-14337 exploit?
CVE-2017-14337 exploits the configuration of X.509 certificate authentication combined with an external user management API.
What impact does CVE-2017-14337 have on my system?
The impact of CVE-2017-14337 is that it may grant unauthenticated users access to the MISP platform.
Is CVE-2017-14337 specific to a certain version of MISP?
Yes, CVE-2017-14337 affects MISP versions prior to 2.4.80.