Skip to content
OpenAdvisories
High WID-SEC-2026-1547 5 CVEs

MISP und MISP Modules: Mehrere Schwachstellen

Published May 14, 2026 · Updated May 14, 2026 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in MISP und MISP Modules ausnutzen, um Informationen offenzulegen, um Admin-Rechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.

Product

MISP ist eine Open-Source-Plattform für den Informationsaustausch über Bedrohungen.

Vulnerabilities 5

  • Critical 9.3
    CVE-2026-44364

    misp-modules website - Missing CSRF protection in the website home blueprint

    MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and earlier, a Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests…

    MISP misp-modules misp-modules PyPI
  • Critical 9.3
    CVE-2026-44381 Scanner template

    MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings

    MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled ordering parameters in the event and shadow attribute listing endpoints. The affected code accepted orde…

    MISP MISP
  • High 8.6
    CVE-2026-44380

    MISP: Improper access control in auth key reset allows privilege escalation to site administrator

    MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, an improper access control vulnerability in the authentication key reset functionality allowed an authenticated organization administrator to reset authentication keys belonging…

    MISP MISP
  • Medium 5.8
    CVE-2026-44363

    Unsafe remote resource fetching in expansion misp-modules

    MISP modules are autonomous modules that can be used to extend MISP for new services. Prior to 3.0.7, an unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The html_to_markdown module accepted arbitrary HTTP(S) URLs witho…

    MISP misp-modules misp-modules PyPI
  • Medium 5.3
    CVE-2026-44379

    MISP: Improper UUID validation in MISP Collections

    MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, MISP Collections did not enforce RFC 4122 UUID validation on the uuid field. As a result, a user able to create or modify Collection records could submit malformed UUID values, …

    MISP MISP

Revision history

  1. #1

    Initiale Fassung

References