Lucene search

GoogleOSV:CVE-2022-48329

HistoryFeb 20, 2023 - 4:15 a.m.

CVE-2022-48329

2023-02-2004:15:11

Google

osv.dev

misp

version 2.4.166

order parameter

vulnerability

attribute.php

galaxycluster.php

workflow.php

logablebehavior.php

software

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.9%

JSON

MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.

CPENameOperatorVersion
mispeq2.4.20
mispeq2.4.51
mispeq2.3.96
mispeq2.4.107
mispeq2.4.81
mispeq2.4.152
mispeq2.4.117
mispeq2.3.130
mispeq2.3.152
mispeq2.3.22

Name	Operator	Version
misp	eq	2.4.20
misp	eq	2.4.51
misp	eq	2.3.96
misp	eq	2.4.107
misp	eq	2.4.81
misp	eq	2.4.152
misp	eq	2.4.117
misp	eq	2.3.130
misp	eq	2.3.152
misp	eq	2.3.22

Rows per page:

1-10 of 3311

References

github.com/MISP/MISP/commit/a73c1c461bc6f8a048eae92b5e99823afd892d1e

github.com/MISP/MISP/commit/afbe08d256d609eee5195c5b0003cfb723ae7af1

github.com/MISP/MISP/compare/v2.4.165...v2.4.166

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.9%

JSON

Related for OSV:CVE-2022-48329