CVE-2020-11458

MEDIUM EPSS 61.8%
Published Apr 2, 20206y ago · Modified Jun 22, 20261w ago
4.9 CVSS 3.1
Medium
Find Similar
Published Apr 2, 2020 6y ago
Last Modified Jun 22, 2026 1w ago

Description

app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP. This does not cause a leak of the full contents of a file, but does cause a leaks of strings that match certain patterns. Among the data that can leak are passwords from database.php or GPG key passphrases from config.php.

CVSS Details

Base Score
4.9
Exploitability
1.2
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
61.8% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Affected Products 1

VendorProductVersionRange
misp-projectmisp* <2.4.124

References 2

  • github.com https://github.com/MISP/MISP/commit/30ff4b6451549dae7b526d4fb3a49061311ed477
    PatchThird Party Advisory
  • matthias.sdfeu.org https://matthias.sdfeu.org/misp-poc.py
    ExploitThird Party Advisory

Remediation

  • github.com https://github.com/MISP/MISP/commit/30ff4b6451549dae7b526d4fb3a49061311ed477
    PatchThird Party Advisory