SB2018120614 - OS Command Injection in misp-project MISP
Published: December 6, 2018 Updated: July 17, 2020
Security Bulletin ID
SB2018120614
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) OS Command Injection (CVE-ID: CVE-2018-19908)
The vulnerability allows a remote authenticated user to execute arbitrary code.
An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking the original filename of the STIX import.
Remediation
Install update from vendor's website.