CVE-2021-39302: SQL Injection
MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply network and application controls while code is remediated: restrict access to the MISP web interface to trusted IPs and/or deploy WAF rules to block SQL-injection payloads and requests containing the vulnerable org parameter or requests that target the functionality implemented in app/Model/Log.php.
- Operational
Inventory your environment and identify all MISP installations running version 2.4.148.
- Operational
Review and remediate the code at app/Model/Log.php: specifically fix handling of the $conditions['org'] value so it cannot be used for SQL injection (validate/whitelist input and stop injecting the value into SQL; use parameterized queries or safe ORM methods).
Event History
Frequently Asked Questions
What is CVE-2021-39302?
CVE-2021-39302 is a vulnerability in MISP 2.4.148 that allows SQL injection via the $conditions['org'] value in the app/Model/Log.php file.
What is the severity of CVE-2021-39302?
The severity of CVE-2021-39302 is critical with a CVSS score of 9.8.
How does CVE-2021-39302 affect MISP?
CVE-2021-39302 affects MISP version 2.4.148 in certain configurations.
How can I fix CVE-2021-39302?
To fix CVE-2021-39302, update to a version of MISP that includes the fix, such as the one mentioned in the reference link.
What is CWE-89?
CWE-89 refers to SQL injection vulnerabilities where an attacker can manipulate SQL queries to execute arbitrary SQL code.