1. Home
  2. CVE Database
  3. CVE-2017-14337
HIGH · 8.1

CVE-2017-14337

When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate ...

Vulnerability Description

When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate authentication and this API returns an empty value, the unauthenticated user can be granted access as an arbitrary user.

CVSS Score

8.1

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Misp-ProjectMisp<= 2.4.79

Related Weaknesses (CWE)

CWE-287

References

FAQ

What is CVE-2017-14337?

CVE-2017-14337 is a vulnerability with a CVSS score of 8.1 (HIGH). When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate ...

How severe is CVE-2017-14337?

CVE-2017-14337 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-14337?

Check the references section above for vendor advisories and patch information. Affected products include: Misp-Project Misp.