—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2023.3911
MISP 2.4.173 released with various bugfixes and improvements
12 July 2023
===========================================================================
AusCERT Security Bulletin Summary
———————————
Product: MISP 2.4.173
Publisher: MISP
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Resolution: Patch/Upgrade
CVE Names: CVE-2023-37307 CVE-2023-37306
Original Bulletin:
https://www.misp-project.org/2023/07/11/MISP.2.4.173.released.html/
Comment: CVSS (Max): 7.5 CVE-2023-37307 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS Source: NVD
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
– ————————–BEGIN INCLUDED TEXT——————–
MISP 2.4.173 released with various bugfixes and improvements
We are pleased to announce the immediate availability of MISP v2.4.173 with a
new password reset feature, along with a host of quality of life improvements
and fixes.
Password reset self-service
We have added a new functionality allowing administrators to enable user
self-service for forgotten passwords. When enabled, users will have an
additional link below the login screen, allowing them to enter their e-mails
and receive a token that can be used to reset their passwords.
The feature requires the user to have a valid encryption key and the lifetime
of the tokens is hard-coded to be 10 minutes.
New dashboard widgets
The dashboard has seen another round of improvements, with various fixes and
new widgets added. 2.4.173 includes the following new widgets:
o Logarithmic events/org chart (Thanks @vincenzocaputo)
o ATT&CK heatmap widget
Additionally, you can now download the raw data used to feed each widget.
Security fixes
2 vulnerabilities have also been resolved:
Stored XSS via select page titles
Improper sanitisation of user-controlled data ending up in view titles lead to
stored XSS
Huge thanks to Ulas Deniz Ilhan from Zigrin Security (absolute heroes at
discovering vulnerabilities in MISP!)
CVE-2023-37307
RCE via uploaded certificates
Malicious administrators could trigger RCE by uploading a well crafted file as
an SSL certificate for the sync connection.
CVE-2023-37306
Additional information on the vulnerability can be found at the excellent blog
post from synacktiv
Huge thanks to @righel for finding and fixing the vulnerability!
As always, we have been diligent with including a long list of fixes, including
for issues with server sync certificate handling, url encoding of spaces in
search strings, CSRF errors and much more! For a detailed list of fixes, please
refer to the changelog.
– ————————–END INCLUDED TEXT——————–
You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to [email protected]
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: [email protected]
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZK4wBckNZI30y1K9AQjwDA/7Bn0gGXr3RzDxHgluEY5X7+bcssnPpvoO
LZuv2iALtpDkcfaewGB8grMX4KkHEIxdL7dQNnvredlT0Gui03lOVZS1LOjgs9OT
eHNSPEJ2rexxddxLAiZyPK8vP/zBBx2GuwLmqQVjrdWbEtgCOl1q7pbJhhM7GL4s
S24bY62jxWFuCRJcPHSnK7NxS7YwC10640sUX1j9c7vcLJ9gG4RRcc+aR7tX4FvH
8ukxgsZz36NQU5QuCDFjpZUXYl+xJ+xxRBbV+IOC1b70cMxPGOxSp8gij+kjGlxU
dJutRFIoizWvqU1CFSPjguKLueM4/nzKBS2VipdGW62Qr7qeO4NxDbRARHR9dkBQ
+3Y9/4NuSakwkrjJgDngB+u2W+avTOQCu9ospZAqCAF1buOfs9xC28rRym/oypqh
HwSn2iZalSzklNWrsBVMQzKUCqFMHJKNZmLPGYMfLpE6efd9lFvlARTTCg6hI2PR
HaxdOXAIirlfkV8An2oMFOu0g6ApZLNYb/7lKeY6wd2TIlXgglcCylRf57TPwaez
e6UUYL7SlE3LwAvuTm7HDu1UbQMjOUS1nE2Bbu0j579nnQd6dbfylH2jklXgMmx/
5kLPmA7paEQkq7ea7sliIaI8e21n57c5HoHvroTL18LjVWsSRxPawN99fyh8o2SJ
i4sljol5KBc=
=AcPm
—–END PGP SIGNATURE—–
Source: Read More
Security Bulletins