CVE-2023-37306

HIGH
Published Jun 30, 20233y ago · Modified Jun 23, 20261w ago
7.5 CVSS 3.1
High
Find Similar
Published Jun 30, 2023 3y ago
Last Modified Jun 23, 2026 1w ago

Description

MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-209

Affected Products 1

VendorProductVersionRange
misp-projectmisp2.4.172any

References 2

  • github.com https://github.com/MISP/MISP/commit/f125630c1c2d0f5d11079d3653ab7bb2ab5cd908
    Patch
  • synacktiv.com https://www.synacktiv.com/publications/php-filter-chains-file-read-from-error-based-oracle
    ExploitThird Party Advisory

Remediation

  • github.com https://github.com/MISP/MISP/commit/f125630c1c2d0f5d11079d3653ab7bb2ab5cd908
    Patch