CyberRota Analysis
AI-GeneratedAn authorization bypass vulnerability in MISP's EventsController::importModule() allows authenticated users and read-only API keys with event view access to modify event data they should not be able to alter. This flaw compromises the integrity of event content, enabling unauthorized data injection or alteration. Organizations utilizing MISP should prioritize addressing this vulnerability to protect the accuracy and reliability of their event data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An authorization bypass in MISP’s EventsController::importModule() allowed authenticated users or read-only API keys with event view access to persist data to events they were not allowed to modify. When an import module returned results in the misp_standard format, the write path did not verify event modification rights before saving the module output. This could allow a view-only user to inject or alter event data, impacting the integrity of MISP event content. The issue was fixed by enforcing the same modification-rights check used by related module result handling paths before processing misp_standard imports.