CVE-2019-9482: Medium severity Misp Misp vulnerability
In MISP 2.4.102, an authenticated user can view sightings that they should not be eligible for. Exploiting this requires access to the event that has received the sighting. The issue affects instances with restrictive sighting settings (event only / sighting reported only).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to events that have sightings so only authorized/trusted users can view those events (adjust MISP instance authorization/ACLs or role permissions to limit who can open events containing sightings).
- Operational
Audit all events that contain sightings and the user accounts with access to those events; revoke or reduce access for any accounts that should not be eligible to view sightings and document remediated exposures.
Event History
Frequently Asked Questions
What is the severity of CVE-2019-9482?
CVE-2019-9482 has been classified as a medium severity vulnerability due to the potential for unauthorized access to sensitive sightings.
How do I fix CVE-2019-9482?
To fix CVE-2019-9482, upgrade your MISP instance to a version later than 2.4.102 where the vulnerability has been addressed.
Who is affected by CVE-2019-9482?
Organizations using MISP version 2.4.102 may be affected, especially those with restrictive sighting settings.
What impacts does CVE-2019-9482 have on MISP users?
CVE-2019-9482 allows authenticated users to view sightings they should not have access to, compromising event confidentiality.
Is user authentication required to exploit CVE-2019-9482?
Yes, to exploit CVE-2019-9482, an attacker must have authenticated access to the MISP instance.