CVE Details
ID CVE-2019-12868
Summary app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and phar:// URLs trigger deserialization.
References
Vulnerable Configurations
  • cpe:2.3:a:misp:misp:2.4.109:*:*:*:*:*:*:*
    cpe:2.3:a:misp:misp:2.4.109:*:*:*:*:*:*:*
CVSS
Base: 6.5 (as of 18-06-2019 - 20:12)
Impact: 6.4
Exploitability:8.0
CWE CWE-502
CAPEC Click the CAPEC title to display a description
  • An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
CVSS v3.1
Base: 7.2 (as of 18-06-2019 - 20:12)
Impact: 5.9
Exploitability:1.2
Exploitability v3.1
Attack ComplexityAttack vectorPrivileges RequiredScopeUser Interaction
LOW NETWORK HIGH UNCHANGED NONE
Impact v3.1
ConfidentialityIntegrityAvailability
HIGH HIGH HIGH
cvss-vector via4 AV:N/AC:L/Au:S/C:P/I:P/A:P
cvss3-vector via4 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
refmap via4
misc https://github.com/MISP/MISP/commit/c42c5fe92783dd306b7600db1f6a25324445b40c
Last major update 18-06-2019 - 20:12
Published 18-06-2019 - 00:15
Last modified 18-06-2019 - 20:12