CVE-2018-12649

NONE EPSS 70.8%
Published Jun 22, 20188y ago · Modified Jun 22, 20261w ago
Find Similar
Published Jun 22, 2018 8y ago
Last Modified Jun 22, 2026 1w ago

Description

An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method instead of a POST HTTP method in the login part, because this protection was only covering POST requests.

Threat Intelligence

EPSS Exploit Probability
70.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-307

Affected Products 1

VendorProductVersionRange
misp-projectmisp2.4.92any

References 1

  • github.com https://github.com/MISP/MISP/commit/6ffacc1e239930e0e8464d0ca16e432e26cf36a9
    PatchThird Party Advisory

Remediation

  • github.com https://github.com/MISP/MISP/commit/6ffacc1e239930e0e8464d0ca16e432e26cf36a9
    PatchThird Party Advisory