CyberRota Analysis
AI-GeneratedA cross-site request forgery (CSRF) vulnerability in the cullEmptyEvents action of MISP allows an attacker to exploit an authenticated user's session via crafted HTTP GET requests, leading to the irreversible deletion of published empty events without user consent. This vulnerability is particularly critical due to the use of skipBlocklist, which prevents tracking of deleted events. Organizations using MISP, especially those with significant event management responsibilities, should prioritize patching this vulnerability to safeguard their data integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's CSRF validation, an attacker could cause an authenticated MISP user with sufficient privileges to invoke the endpoint simply by causing their browser to load a crafted URL, for example through an embedded image or other automatically requested resource. Successful exploitation triggers the deletion of published empty events. The deletion is particularly significant because the operation uses skipBlocklist, meaning the removed events do not leave blocklist entries that could prevent or track their subsequent synchronization. This can result in unintended and potentially irreversible deletion of MISP event records without explicit user interaction. The vulnerability was addressed by restricting cullEmptyEvents to HTTP POST requests, ensuring that CakePHP's normal CSRF protections are applied to the operation.
Related CVEs
Other vulnerabilities affecting the same vendor(s)