CVE-2018-19908

An issue was discovered in MISP 2.4.9x before 2.4.99

published December 6, 2018

CVSS
—
EPSS
17%
Percentile
97.1
In the wild
Unconfirmed
What it is

An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking the original filename of the STIX import.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.17295 · 97.1th percentile
Published
2018-12-06T16:00Z
EPSS history
Timeline
  • 06 DEC 16:00Z
    An issue was discovered in MISP 2.4.9x before 2.4.99
    cvelistv5