CVE-2024-46918

app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in…

Critical · published September 15, 2024

CVSS v3.1
9.8
EPSS
0%
Percentile
37.2
In the wild
Unconfirmed
What it is

app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in the same org.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00440 · 37.2th percentile
Published
2024-09-15T00:00Z
EPSS history
Timeline
  • 15 SEP 00:00Z
    app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in…
    cvelistv5