QSearchQSearch

CVE-2021-31780

7.5 HIGH

In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit

Published: 2021-04-23 · Last updated: 2026-06-22

Severity and scoring

CVSS
7.5 HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
CWE-212

Affected products

VendorProduct
misp-projectmisp

Description

In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit. When an object has a sharing group associated with an event edit, the sharing group object is ignored and instead the passed local ID is reused.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2021-41326 — In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call (9.8 CRITICAL)
  • CVE-2021-39302 — MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value (9.8 CRITICAL)
  • CVE-2021-37743 — app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format (5.4 MEDIUM)
  • CVE-2021-37742 — app/View/Elements/GalaxyClusters/view_relation_tree.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster relationships (5.4 MEDIUM)
  • CVE-2021-37534 — app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster (5.4 MEDIUM)

Same CWE

  • CVE-2026-54421 — In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can re... (6.8 MEDIUM)
  • CVE-2026-46657 — Bludit is a content management system (7.1 HIGH)
  • CVE-2026-36178 — The factory reset functionality in GNCC GP5 v7.1.76 fails to clear sensitive cryptographic material in the JFFS2 configuration partition,... (4.6 MEDIUM)
  • CVE-2026-45046 — Gryph provides a security layer for AI coding agents (5.5 MEDIUM)
  • CVE-2026-27892 — FacturaScripts is an open source accounting and invoicing software (6.5 MEDIUM)