CVE-2017-14337

N/A

Description

When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate authentication and this API returns an empty value, the unauthenticated user can be granted access as an arbitrary user.

CVE Details

CVSS v3.1 ScoreN/A

Published9/12/2017

Last Modified4/20/2025

Sourcenvd

Honeypot Sightings0

Affected Products

misp-project:misp

Weaknesses (CWE)

CWE-287

References

https://github.com/MISP/MISP/commit/be111a470204a974c50682054c9c7d4b94396ed9(cve@mitre.org)

https://www.circl.lu/advisory/CVE-2017-14337/(cve@mitre.org)

https://github.com/MISP/MISP/commit/be111a470204a974c50682054c9c7d4b94396ed9(af854a3a-2127-422b-91ae-364da2661108)

https://www.circl.lu/advisory/CVE-2017-14337/(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.