CyberRota Analysis
AI-GeneratedThe interactive CLI shell in affected versions of MISP fails to consistently maintain the identity of the impersonated user during audit logging, leading to potential misattribution of actions. This vulnerability could allow malicious actors to obscure their activities, complicating forensic investigations and accountability. Organizations using MISP versions 2.5.45 or earlier should prioritize addressing this issue to ensure accurate logging and user accountability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user. Version affected: ≤2.5.45