MISP 2.4.121 patches five vulnerabilities
MISP 2.4.121 fixes five vulnerabilities including a reflected XSS and multiple brute-force protection bypasses.
Sourcemisp-project.org — open the original
What to check
- Applies to
- The 5 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
The MISP threat-intelligence platform project released version 2.4.121, a security and bug-fix release addressing five vulnerabilities reported by researcher Dawid Czarnecki. The issues include a reflected cross-site scripting flaw in the galaxy view (CVE-2020-8893), an access-control list bypass affecting discussion threads (CVE-2020-8894), and a set of brute-force protection weaknesses. The brute-force issues stem from potential time skew between the web server and database causing the protection to not trigger (CVE-2020-8890), missing username canonicalization before logging bruteforce entries (CVE-2020-8891), and PUT requests on the login endpoint bypassing the protection entirely (CVE-2020-8892).
The project states none of the vulnerabilities are deemed critical, but strongly recommends users update and inform peers to do the same. Alongside the security fixes, the release adds new sync pull filters to limit unfiltered flow of aged-out data during initial community synchronization, corrects background worker configuration loading behavior, improves memory envelope estimation for large datasets, and enhances SQL schema check diagnostics. Several new MISP object templates were also added covering disinformation, media, and improved HTTP representation use cases.
This is a routine maintenance and security patch release for MISP administrators rather than an actively exploited threat, warranting prompt but non-urgent patching.
Mentioned in this report
Source reporting: https://www.misp-project.org/2020/02/12/misp.2.4.121.released.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs