CVE-2026-54358
0.04%V4
2026-06-12
20h16 +00:00
20h16 +00:00
Notifikasi untuk CVE tertentu
Tetap terinformasi tentang perubahan untuk CVE tertentu.
Deskripsi CVE
An incorrect authorization vulnerability in MISP allows an organization administrator to target site administrator accounts belonging to the same organization through the administrative email functionality. The affected code restricted organization administrators to users within their own organization, but did not exclude accounts assigned a site administrator role from recipient queries. As a result, an organization administrator could perform privileged account-management actions, such as initiating a password reset workflow, against a higher-privileged site administrator account in the same organization.
Successful exploitation may allow an authenticated organization administrator to interfere with or potentially take over a site administrator account, resulting in privilege escalation and full compromise of the MISP instance’s confidentiality, integrity, and availability.
Attack prerequisites:
The attacker must be authenticated as an organization administrator in the same organization as a site administrator account.
Informasi CVE
Kelemahan Terkait
| Nama Kelemahan | Sumber | |
|---|---|---|
| Incorrect Authorization The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
EPSS
EPSS adalah model penilaian yang memprediksi kemungkinan suatu kerentanan dieksploitasi.
Skor EPSS
Model EPSS menghasilkan skor probabilitas antara 0 dan 1 (0 hingga 100%). Semakin tinggi skor, semakin besar probabilitas bahwa suatu kerentanan akan dieksploitasi.
Persentil EPSS
Persentil digunakan untuk meranking CVE berdasarkan skor EPSS mereka. Misalnya, CVE di persentil ke-95 berdasarkan skor EPSS-nya lebih mungkin dieksploitasi daripada 95% CVE lainnya. Dengan demikian, persentil digunakan untuk membandingkan skor EPSS suatu CVE dengan CVE lainnya.
