CVE-2020-12889

MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case

published May 15, 2020

CVSS
—
EPSS
1%
Percentile
68.7
In the wild
Unconfirmed
What it is

⚠️ A sneaky mix-up in MISP-maltego 1.4.4 lets users share a connection like a communal umbrella in a rainstorm—great in theory, but disastrous if someone forgets to close it! ☔️ It's like a coffee shop where the barista accidentally uses the same cup for multiple customers. Imagine getting someone else's order at the counter because the system just can’t tell who the drink belongs to! This issue could lead to users unintentionally accessing each other's MISP connections, which opens the door to data leaks and privacy breaches. Imagine your confidential information getting mixed up with someone else's—absolutely devastating!

Put simply

It's like a coffee shop where the barista accidentally uses the same cup for multiple customers. Imagine getting someone else's order at the counter because the system just can’t tell who the drink belongs to! In MISP-maltego 1.4.4, a flaw in the remote-transform functionality allows the incorrect sharing of MISP connections across different users, leading to an exposure of sensitive data.

What to do

This issue could lead to users unintentionally accessing each other's MISP connections, which opens the door to data leaks and privacy breaches. Imagine your confidential information getting mixed up with someone else's—absolutely devastating! To protect your setup, consider updating to the latest version of MISP-maltego once a patch is released, and ensure that user sessions are properly isolated to prevent this mix-up. Regularly review your security settings to tighten access controls. 🛡️ You've got this! Stay vigilant and ensure your connections are secure, and you'll be a security hero in no time! 💪✨

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01230 · 68.7th percentile
Published
2020-05-15T17:53Z
EPSS history
Timeline
  • 15 MAY 17:53Z
    MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case
    cvelistv5