CyberRota Analysis
AI-GeneratedMISP versions up to 2.5.45 are vulnerable due to inadequate authorization in the CryptographicKeysController::view() function, which allows any authenticated user to access sensitive cryptographic keys without verifying the associated parent event. This oversight could lead to unauthorized disclosure of critical data, including key types and fingerprints, potentially compromising the integrity of cryptographic operations. Organizations using MISP should prioritize patching this vulnerability to safeguard their cryptographic assets and maintain data confidentiality.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view(). The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as: * type * key_data * fingerprint but did not fetch or authorize the associated parent event first. The upstream commit explicitly states that cryptographicKeys/view could return a protected event’s signing key to any authenticated user. The fix adds parent_id and parent_type to the lookup and then enforces authorization through the associated event using fetchSimpleEvent($user, parent_id). If the parent is not an Event, access is limited to site administrators. Version affected: ≤2.5.45
Related CVEs
Other vulnerabilities affecting the same vendor(s)