CVE-2022-48328 Other in n/a

Critical 9.8 Published 20 Feb 2023 Updated 27 Nov 2024

MISP mishandles URL parameters and delimiters, potentially causing unexpected behavior or errors in filtering logic.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-48328?

CVE-2022-48328 is a critical vulnerability in Misp-Project Misp, published on 20 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.

Weakness: CWE-755

Which versions are affected by CVE-2022-48328?

It affects 1 product.

Products include Misp-Project Misp.

How do I fix CVE-2022-48328?

No fix has been published for CVE-2022-48328 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-48328 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-48328 exists.

All Misp-Project Misp vulnerabilities

Sources

Also known as GHSA-2pq9-cj9c-6vgr.