CVE-2022-29534

ALTO 7.5CVE-2022-29534 · Published 20/04/2022 · updated 22/06/2026

In breve

CVE-2022-29534 è una vulnerabilità ALTO (CVSS 7.5) che riguarda misp (misp-project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.6%, superiore al 75.8% delle vulnerabilità.
Correzione: aggiornare a 2.4.158 o successiva.

Package	Affected versions	Patched versions
misp misp-project	`< 2.4.158`	`2.4.158`

Description

An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header.

References

MISP/MISP commit 0112016 · Patch
MISP/MISP · Release Notes
zigrin.com/advisories/misp-password-confirmation-can-be-bypassed · Third Party Advisory
zigrin.com/cakephp-application-cybersecurity-research-the-impact-of-a-php-vulnerability-exploring-the-password-confirmation-bypass-in-misp · Exploit

Altre vulnerabilità di misp

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

misp

misp-project

< 2.4.158

2.4.158

Altre vulnerabilità di misp

Vedi tutto →