Executive Summary

This vulnerability is an authorization flaw in MISP's object add/edit handling. It allows an authenticated user who has permissions to edit objects to assign a MISP object or its contained attributes to a sharing group that the user is not authorized to access or view.

The flaw occurs because the sharing group validation is performed against the wrong data structure after object fields have been merged to the top level, which causes the validation check to be bypassed. Additionally, attributes embedded within objects are not individually validated for authorized sharing group use.

An attacker could exploit this by crafting a request with a specific distribution setting and an arbitrary sharing group ID, potentially revealing the existence or name of sharing groups that should be hidden and improperly modifying the distribution metadata of objects or their attributes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized disclosure of information about sharing groups that you are not permitted to see.

It also allows unauthorized modification of the distribution metadata of MISP objects or their contained attributes, which could lead to improper sharing or exposure of sensitive threat intelligence data.

Useful 0 Not Useful 0