DeutschShown in its original language — a full translation is planned for a future version.
MISP: Mehrere Schwachstellen
view advisory published 2026-06-22
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um beliebigen Code auszuführen, Zugriffskontrollen zu umgehen, Daten zu verändern, vertrauliche Informationen offenzulegen, Benutzersitzungen zu kapern oder einen Denial-of-Service-Zustand zu verursachen.
01
describes (6)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-56447US | high7.2 | — | ||
MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path. MISP subsequently parsed the referenced INI file and passe… | ||||
| CVE-2026-56446US | high7.2 | — | ||
MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log entries can include attacker-controlled conten… | ||||
| CVE-2026-56425US | high8.8 | — | ||
The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to bypass important secu… | ||||
| CVE-2026-56424US | high8.8OT elevated | — | ||
MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability checks were missing on w… | ||||
| CVE-2026-56423US | high8.8OT high | Exploit | ||
MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized deletion using br… | ||||
| CVE-2026-56422US | — | — | ||
Multiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (id) and ownership/scope foreign keys (event_id, org_id, user_… | ||||
02
references
External citations — patches, advisories, analysis.
- MISP 2.5.42 Release vom 2026-06-22external
- GitHub Advisory Database vom 2026-06-22external
- GitHub Advisory Database vom 2026-06-22external
- GitHub Advisory Database vom 2026-06-22external
- GitHub Advisory Database vom 2026-06-22external
- GitHub Advisory Database vom 2026-06-22external
- GitHub Advisory Database vom 2026-06-22external
- WID-SEC-W-2026-2035 - CSAF Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan