CVE-2017-16946: Medium severity Misp Misp vulnerability
The adminedit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enablepassword field, which allows admins to discover a hashed password by reading the audit log.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the admin_edit function in app/Controller/UsersController.php so that the enable_password field is not written to the audit log or is masked (for example, replace the field value with a fixed placeholder such as '****') before any logging occurs.
MISP app/Controller/UsersController.php (admin_edit) enable_password audit logging = masked or removed - Compensating control
Restrict and harden access to MISP audit logs (limit to trusted administrators only, enforce strict ACLs and logging of log-access) until the code is fixed to prevent further exposure via audit logs.
- Operational
Search existing audit logs for entries that include the enable_password field (or contain hashed password values) and rotate any user passwords whose hashes may have been exposed in those logs.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16946?
CVE-2017-16946 is considered a medium severity vulnerability due to its potential impact on the confidentiality of hashed passwords.
How do I fix CVE-2017-16946?
To fix CVE-2017-16946, you should upgrade MISP to a version later than 2.4.82 where the issue has been resolved.
Who is affected by CVE-2017-16946?
CVE-2017-16946 affects installations of MISP version 2.4.82 specifically.
What are the risks associated with CVE-2017-16946?
The main risk of CVE-2017-16946 is that an admin could inadvertently expose hashed passwords through audit logs.
Is CVE-2017-16946 easy to exploit?
CVE-2017-16946 is not considered easy to exploit as it requires access to the audit logs by an administrator.