ID CVE-2018-6926
Summary In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and CentOS systems (where rh_shell_fix was enabled), and consequently allowed site admins to inject arbitrary OS commands. The impact is limited by the setting being only accessible to the site administrator.
References
Vulnerable Configurations
CVSS
Base: None
Impact:
Exploitability:
refmap via4
confirm https://github.com/MISP/MISP/commit/0a2aa9d52492d960b9a161160acedbe9caaa4126
Last major update 12-02-2018 - 12:29
Published 12-02-2018 - 12:29
Last modified 12-02-2018 - 12:29
Back to Top