MISP 2.4.89 patches two security bugs
MISP 2.4.89 fixes an XSS flaw in misp-modules and an API integrity bug allowing attribute overwrite, alongside new event graph and STIX 2.0 features.
The MISP threat-sharing platform released version 2.4.89, addressing two security vulnerabilities alongside a batch of feature updates. CVE-2018-8948 concerns improper sanitisation from misp-modules, which could allow cross-site scripting via malicious expansion modules. CVE-2018-8949 is an API integrity issue where an authenticated user could edit or overwrite an attribute lacking a UUID, bypassing expected access controls.
Beyond the security fixes, the release adds a graphical event graph viewer/editor for objects, attributes, and relationships, STIX 2.0 import support in addition to existing export capability, and various API improvements including UUID exposure in attribute-level restSearch and mass-delete for attributes. A separate non-CVE bug affecting the object handler, which could allow objects to be overwritten under specific conditions, was also remediated with a new diagnostics recovery tool.
This is a routine software maintenance release for a widely used open-source threat intelligence platform; the vulnerabilities are low-severity and require authenticated access or reliance on malicious third-party modules, with no indication of active exploitation.
Mentioned in this report
Source reporting: https://www.misp-project.org/2018/03/23/misp.2.4.89.released.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free