8.1high
CVE-2017-14337
When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user managem…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
8.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 61%
Public exploits
0
none known
Summary
When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate authentication and this API returns an empty value, the unauthenticated user can be granted access as an arbitrary user.
Exploit prediction (EPSS)
0.93% probability of exploitation in the next 30 days, higher than 61% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-287 Improper Authentication
References
- github.com /MISP/MISP/commit/be111a470204a974c50682054c9c7d4b94396ed9 · x_refsource_CONFIRM, x_transferred
- circl.lu /advisory/CVE-2017-14337/ · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-14337
- NVD: CVE-2017-14337
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.