CVE-2022-42724

MEDIUM

Published Oct 10, 20223y ago · Modified Jun 23, 20261w ago

4.3 CVSS 3.1

Medium

Published Oct 10, 2022 3y ago

Last Modified Jun 23, 2026 1w ago

Description

app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have).

CVSS Details

Base Score

4.3

Exploitability

2.8

Impact

1.4

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality Low

Integrity None

Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-863 Incorrect Authorization Authorization

Affected Products 1

Vendor	Product	Version	Range
misp-project	misp	*	<2.4.164

References 1

github.com https://github.com/MISP/MISP/commit/934b9cd4fc6d6378ad349ea630ad9f1319ac82f5

PatchThird Party Advisory

Remediation

github.com https://github.com/MISP/MISP/commit/934b9cd4fc6d6378ad349ea630ad9f1319ac82f5

PatchThird Party Advisory