CVE-2021-41326

2021-09-1718:15:08

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.3%

JSON

In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call.

CPENameOperatorVersion
mispeq2.4.54
mispeq2.4.96
mispeq2.4.125
mispeq2.3.78
mispeq2.3.141
mispeq2.4.59
mispeq2.4.49
mispeq2.4.107
mispeq2.3.158
mispeq2.4.95

Name	Operator	Version
misp	eq	2.4.54
misp	eq	2.4.96
misp	eq	2.4.125
misp	eq	2.3.78
misp	eq	2.3.141
misp	eq	2.4.59
misp	eq	2.4.49
misp	eq	2.4.107
misp	eq	2.3.158
misp	eq	2.4.95

Rows per page:

1-10 of 3131

References

github.com/MISP/MISP/commit/e36f73947e741bc97320f0c42199acd1a94c7051

github.com/MISP/MISP/compare/v2.4.147...v2.4.148

zigrin.com/advisories/misp-command-injection-vulnerability-in-opendata-export/