From 65a18d9a1720e866873ea526389fe1764a0d0e7e Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Wed, 11 Sep 2019 09:19:02 +0200 Subject: [PATCH] chg: [security] CVE-2019-16202 added --- _pages/security.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/_pages/security.md b/_pages/security.md index 519d5b5..8a1758d 100755 --- a/_pages/security.md +++ b/_pages/security.md @@ -38,7 +38,8 @@ As one of the critical user-bases of MISP consists of the CSIRT community, it is - [CVE-2019-11814](https://cve.circl.lu/cve/CVE-2019-11814) <= MISP 2.4.107 - An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated by a screenshot. - [CVE-2019-12794](https://cve.circl.lu/cve/CVE-2019-12794) <= MISP 2.4.108 - An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins (organization admins have the inherent ability to reset passwords for all of their organization's users). - [CVE-2019-12868](https://cve.circl.lu/cve/CVE-2019-12868) <= MISP 2.4.109 - app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and phar:// URLs trigger deserialization. -- [CVE-2019-14286](https://cve.circl.lu/cve/CVE-2019-14286) <= MISP 2.4.111 - In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicious MISP event must be crafted in order to trigger the vulnerability. +- [CVE-2019-14286](https://cve.circl.lu/cve/CVE-2019-14286) <= MISP 2.4.111 - In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicious MISP event must be crafted in order to trigger the vulnerability. +- [CVE-2019-16202](https://cve.circl.lu/cve/CVE-2019-16202) <= MISP 2.4.114 - MISP before 2.4.115 allows privilege escalation in certain situations. After updating to 2.4.115, escalation attempts are blocked by the checkLoggedActions function with a "This could be an indication of an attempted privilege escalation on older vulnerable versions of MISP (<2.4.115)" message. ## PGP Key