CVE-2018-19908

Published: Dec 6, 2018Modified: Nov 21, 2024

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking the original filename of the STIX import.

Affected (1)

Products: Misp: Misp

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Misp Misp	From 2.4.90 to 2.4.99

Related CWEs

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (6)

https://github.com/MISP/MISP/commit/211ac0737281b65e7da160f0aac52f401a94e1a3

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/MISP/MISP/releases/tag/v2.4.99

Source: cve@mitre.org

Release NotesThird Party Advisory

https://www.exploit-db.com/exploits/46401/

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

https://github.com/MISP/MISP/commit/211ac0737281b65e7da160f0aac52f401a94e1a3

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/MISP/MISP/releases/tag/v2.4.99

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

https://www.exploit-db.com/exploits/46401/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

Timeline

No history available yet.