| Package | Affected versions | Patched versions |
|---|---|---|
| misp | ≥ 2.4.90, < 2.4.99 | 2.4.99 |
An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking the original filename of the STIX import.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free