CVE-2018-19908

2018-12-0616:29:00

Google

osv.dev

7.4 High

AI Score

Confidence

High

0.034 Low

EPSS

Percentile

91.5%

JSON

An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking the original filename of the STIX import.

CPENameOperatorVersion
mispeq2.3.71
mispeq2.4.40
mispeq2.3.158
mispeq2.3.99
mispeq2.3.68
mispeq2.3.145
mispeq2.3.15
mispeq2.3.45
mispeq2.3.39
mispeq2.4.71