Unrated severityOSV Advisory· Published Dec 6, 2018· Updated Aug 5, 2024
CVE-2018-19908
CVE-2018-19908
Description
An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking the original filename of the STIX import.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
3- www.exploit-db.com/exploits/46401/mitreexploitx_refsource_EXPLOIT-DB
- github.com/MISP/MISP/commit/211ac0737281b65e7da160f0aac52f401a94e1a3mitrex_refsource_MISC
- github.com/MISP/MISP/releases/tag/v2.4.99mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.