CVE-2018-12649: Critical severity Misp Misp vulnerability
An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method instead of a POST HTTP method in the login part, because this protection was only covering POST requests.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-12649?
CVE-2018-12649 is considered a moderate severity vulnerability as it allows an attacker to bypass brute-force protection.
How do I fix CVE-2018-12649?
To fix CVE-2018-12649, update MISP to a version later than 2.4.92 that addresses this issue.
What does CVE-2018-12649 affect?
CVE-2018-12649 specifically affects MISP version 2.4.92 in the UsersController.php file.
What method can bypass the brute-force protection in CVE-2018-12649?
An attacker can bypass the brute-force protection in CVE-2018-12649 by using the PUT HTTP method instead of POST.
Is there a patch available for CVE-2018-12649?
Yes, a patch is available in later versions of MISP that address the vulnerability described in CVE-2018-12649.