CVE-2018-19908

An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php the STIX 1 import code, an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking the original filenam...

PT-2018-15158

Name of the Vulnerable Software and Affected Versions MISP versions 2.4.9x through 2.4.98 Description An issue was discovered in the STIX 1 import code of MISP, where an unescaped filename string is used to construct a shell command. This can be abused by a malicious authenticated user to execute...

CVE-2018-19908: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php the STIX 1 import code, an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking the original filenam...