CVE-2023-37306: High severity Misp-project Malware Information Sharing Platform vulnerability

Published Jun 30, 2023

Updated

MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.

Affected Software

2 affected components

Misp-project Malware Information Sharing Platform=2.4.172

Misp-project Misp=2.4.172

Remediation

Patch Available

https://github.com/MISP/MISP/commit/f125630c1c2d0f5d11079d3653ab7bb2ab5cd908

Event History

Jun 30, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·05:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID of this issue?

The vulnerability ID of this issue is CVE-2023-37306.

What is the severity of CVE-2023-37306?

The severity of CVE-2023-37306 is high (7.5).

How does MISP 2.4.172 mishandle different certificate file extensions in server sync?

MISP 2.4.172 mishandles different certificate file extensions in server sync, allowing an attacker to obtain sensitive information through error messages.

How can an attacker exploit CVE-2023-37306?

An attacker can exploit CVE-2023-37306 by leveraging the mishandling of certificate file extensions in MISP 2.4.172 server sync to obtain sensitive information.

Are there any references related to CVE-2023-37306?

Yes, you can find more information about CVE-2023-37306 at the following references: [Link 1](https://github.com/MISP/MISP/commit/f125630c1c2d0f5d11079d3653ab7bb2ab5cd908), [Link 2](https://www.synacktiv.com/publications/php-filter-chains-file-read-from-error-based-oracle).