CVE-2023-37306

Published: Jun 30, 2023Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.

Affected (1)

Products: Misp Project: Malware Information Sharing Platform

Misp Project

1 product

Malware Information Sharing Platform

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Misp Project Malware Information Sharing Platform	Version 2.4.172

Related CWEs

CWE-209

Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

References (4)

https://github.com/MISP/MISP/commit/f125630c1c2d0f5d11079d3653ab7bb2ab5cd908

Source: cve@mitre.org

Patch

https://www.synacktiv.com/publications/php-filter-chains-file-read-from-error-based-oracle

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/MISP/MISP/commit/f125630c1c2d0f5d11079d3653ab7bb2ab5cd908

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://www.synacktiv.com/publications/php-filter-chains-file-read-from-error-based-oracle

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.