Vulnerability Description
MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.
CVSS Score
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Misp-Project | Malware Information Sharing Platform | 2.4.172 |
Related Weaknesses (CWE)
References
- https://github.com/MISP/MISP/commit/f125630c1c2d0f5d11079d3653ab7bb2ab5cd908Patch
- https://www.synacktiv.com/publications/php-filter-chains-file-read-from-error-baExploitThird Party Advisory
- https://github.com/MISP/MISP/commit/f125630c1c2d0f5d11079d3653ab7bb2ab5cd908Patch
- https://www.synacktiv.com/publications/php-filter-chains-file-read-from-error-baExploitThird Party Advisory
FAQ
What is CVE-2023-37306?
CVE-2023-37306 is a vulnerability with a CVSS score of 7.5 (HIGH). MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.
How severe is CVE-2023-37306?
CVE-2023-37306 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-37306?
Check the references section above for vendor advisories and patch information. Affected products include: Misp-Project Malware Information Sharing Platform.