CVE-2024-45509: Critical severity Misp-project Misp vulnerability
In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Modify app/Controller/BookmarksController.php in MISP to enforce authorization checks that restrict access to bookmarks data to organization administrators only. Update the controller methods to verify the requesting user's org-admin status before returning or exposing bookmark records, deploy the updated code, and validate by testing with non-org-admin accounts to confirm they cannot access bookmarks they should not see.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45509?
CVE-2024-45509 has been assigned a medium severity rating due to improper access control in bookmark data.
How do I fix CVE-2024-45509?
To fix CVE-2024-45509, upgrade your MISP instance to a version greater than 2.4.196.
What are the implications of CVE-2024-45509?
CVE-2024-45509 allows non-org admin users to access bookmarks data, potentially leading to data exposure.
Which versions of MISP are affected by CVE-2024-45509?
Versions of MISP prior to 2.4.197 are affected by CVE-2024-45509.
Who can exploit CVE-2024-45509?
Any user with non-org admin privileges may exploit CVE-2024-45509 to gain unauthorized access to bookmarks data.