Vulnerability-Lookup

GHSA-MP6X-6C2R-XCXV

Vulnerability from github – Published: 2026-10-19 12:32 – Updated: 2026-10-19 12:32

Details

MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.

The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.

A second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.

The impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.

Affected versions: <2.5.48.

Severity

7.1 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-112188"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-19T10:16:47Z",
    "severity": "HIGH"
  },
  "details": "MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.\n\nThe settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.\n\nA second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.\n\nThe impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.\n\nAffected versions: \u003c2.5.48.",
  "id": "GHSA-mp6x-6c2r-xcxv",
  "modified": "2026-10-19T12:32:47Z",
  "published": "2026-10-19T12:32:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112188"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MISP/MISP/commit/30b849102"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-112188 (GCVE-0-2026-112188)

Vulnerability from cvelistv5 – Published: 2026-10-19 09:22 – Updated: 2026-10-19 09:22

Title

MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution

Summary

MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys. A second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller. The impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints. Affected versions: <2.5.48.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

Supplier · CIRCL (v2.0.3)

Decision recorded 2026-10-19 09:21 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-285 - Improper Authorization

Assigner

CIRCL CNA under the ENISA root

CNA scorecard A 90/100 over 244 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/MISP/MISP/commit/30b849102	patch

Impacted products

1 product

Vendor	Product	Version
MISP	MISP	Affected: 0 , < 2.5.48 (semver) cpe:2.3:a:misp:misp::::::::

Credits

Jeroen Pinoy iglocska Claude Opus 5

GCVE extensions

AI-generated Human-reviewed Confidence: medium Model qwen3.8:27b 1 event advisory bcp-05-x-01bcp-05-x-02bcp-05-x-03

bcp-05-x-01

AI-assisted vulnerability information annotation

GCVE-BCP-05-X-01

Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification

Model	Source	Identifier
qwen3.8:27b	ollama	`qwen3.8:27b`

bcp-05-x-02

Patch-to-vulnerability generation provenance

GCVE-BCP-05-X-02

Generator: patch2vuln.py on 2026-10-19 09:21
Model: qwen3.8:27b
Input: https://github.com/MISP/MISP/commit/30b849102.patch 70885748c270…
Confidence: medium

Commit	Subject	Patch SHA-256
`30b849102c68`	fix: [settings] Server setting lookups address one setting,	`70885748c270…`

Fix summary

The settings lookup function now validates that the resolved node is a leaf setting (has a 'level' property and is not an array representing a branch). If the resolved node is a branch or otherwise does not represent a single setting, the function returns false, indicating an invalid setting. This prevents the redaction check from being bypassed and stops the endpoints from returning entire configuration branches containing sensitive values.

Patch summary

In app/Model/Server.php, the getSettingData() method previously checked only for the presence of a 'level' key before returning the setting. The patch adds a guard clause: if the resolved setting is an array (i.e., a branch/sub-tree) or lacks the 'level' key, the function immediately returns false. The existing logic for setting the name and resolving options is then applied only to confirmed leaf settings. This ensures callers that assumed a single-setting result never receive a multi-key branch.

CVSS rationale

AV:N: MISP is a network-accessible web application. AC:L: The attack requires only substituting a branch name for a leaf setting name in an existing API call; no race conditions or complex timing are needed. AT:N: No manipulation of the target environment is required. PR:L: The attacker needs an authenticated account with access to the server settings endpoints; the exact privilege level (admin vs. regular user) is not confirmed in the patch, so Low is assumed. UI:N: No victim interaction is required. VC:H: Sensitive secrets (security salt, Redis passwords, plugin API keys) are fully disclosed. VI:N, VA:N: No integrity or availability impact is evidenced. SC:N, SI:N, SA:N: No impact on subsequent components is indicated.

Weakness rationale

CWE-200 The settings endpoint returned sensitive configuration values (security salt, Redis passwords, plugin API keys) to a caller who requested a branch name, bypassing the intended redaction mechanism. The data was exposed to an actor who should not have had access to those specific values.
CWE-285 The redaction check, which serves as an authorization control for sensitive setting values, was effectively bypassed because branch nodes do not carry a redacted flag. The system failed to enforce the intended access restriction on sensitive configuration data.

Attack pattern rationale

CAPEC-124 The attacker manipulates the setting name parameter supplied to the settings lookup endpoint, substituting a branch name (e.g., 'Security') for a leaf setting name. This causes the application to return a broader data set than intended. CAPEC-124 is the closest match because the core technique is altering a request parameter to change the application's response scope. The mapping is approximate because the parameter is not a traditional HTTP parameter but an application-level setting identifier; no CAPEC specifically covers configuration-tree traversal.

Assumptions to verify

The exact privilege level required to access the server settings endpoints (admin vs. any authenticated user) is not stated in the patch; PR:L is assumed as the most conservative defensible value.
The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 11 commits after fix); the exact last affected version and first fixed version are not explicitly confirmed.
CAPEC-124 (Parameter Tampering) is the closest available attack pattern; no CAPEC specifically models configuration-tree branch traversal, so the mapping is approximate.
The patch does not indicate whether unauthenticated access is possible; authentication is assumed based on the nature of server settings endpoints in MISP.
The Co-Authored-By line references an AI tool (Claude Opus 5); it is listed as a tool credit rather than a human remediation developer.

Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model	Score	Agreement	Confidence	Assumptions
`qwen3.8:27b`	7	11	medium	5

bcp-05-x-03

Vulnerability handling and disclosure timeline

GCVE-BCP-05-X-03

2026-09-28 10:03 UTC Fix developed Corrective change authored (30b849102c687bb53919f1d5d20851bc20fafa4e): fix: [settings] Server setting lookups address one setting, https://github.com/MISP/MISP/commit/30b849102.patch

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Server settings (app/Model/Server.php)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Server.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.\u003c/p\u003e\u003cp\u003eThe settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.\u003c/p\u003e\u003cp\u003eA second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.\u003c/p\u003e\u003cp\u003eThe impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.\n\nThe settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.\n\nA second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.\n\nThe impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.\n\nAffected versions: \u003c2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-124",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-124 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "total"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T09:21:00Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:22:37.880Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/30b849102"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe settings lookup function now validates that the resolved node is a leaf setting (has a \u0027level\u0027 property and is not an array representing a branch). If the resolved node is a branch or otherwise does not represent a single setting, the function returns false, indicating an invalid setting. This prevents the redaction check from being bypassed and stops the endpoints from returning entire configuration branches containing sensitive values.\u003c/p\u003e"
            }
          ],
          "value": "The settings lookup function now validates that the resolved node is a leaf setting (has a \u0027level\u0027 property and is not an array representing a branch). If the resolved node is a branch or otherwise does not represent a single setting, the function returns false, indicating an invalid setting. This prevents the redaction check from being bypassed and stops the endpoints from returning entire configuration branches containing sensitive values."
        }
      ],
      "title": "MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact privilege level required to access the server settings endpoints (admin vs. any authenticated user) is not stated in the patch; PR:L is assumed as the most conservative defensible value.",
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 11 commits after fix); the exact last affected version and first fixed version are not explicitly confirmed.",
                  "CAPEC-124 (Parameter Tampering) is the closest available attack pattern; no CAPEC specifically models configuration-tree branch traversal, so the mapping is approximate.",
                  "The patch does not indicate whether unauthenticated access is possible; authentication is assumed based on the nature of server settings endpoints in MISP.",
                  "The Co-Authored-By line references an AI tool (Claude Opus 5); it is listed as a tool credit rather than a human remediation developer."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-124",
                    "rationale": "The attacker manipulates the setting name parameter supplied to the settings lookup endpoint, substituting a branch name (e.g., \u0027Security\u0027) for a leaf setting name. This causes the application to return a broader data set than intended. CAPEC-124 is the closest match because the core technique is altering a request parameter to change the application\u0027s response scope. The mapping is approximate because the parameter is not a traditional HTTP parameter but an application-level setting identifier; no CAPEC specifically covers configuration-tree traversal."
                  }
                ],
                "commit": "30b849102c687bb53919f1d5d20851bc20fafa4e",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attack requires only substituting a branch name for a leaf setting name in an existing API call; no race conditions or complex timing are needed. AT:N: No manipulation of the target environment is required. PR:L: The attacker needs an authenticated account with access to the server settings endpoints; the exact privilege level (admin vs. regular user) is not confirmed in the patch, so Low is assumed. UI:N: No victim interaction is required. VC:H: Sensitive secrets (security salt, Redis passwords, plugin API keys) are fully disclosed. VI:N, VA:N: No integrity or availability impact is evidenced. SC:N, SI:N, SA:N: No impact on subsequent components is indicated.",
                "fixSummary": "The settings lookup function now validates that the resolved node is a leaf setting (has a \u0027level\u0027 property and is not an array representing a branch). If the resolved node is a branch or otherwise does not represent a single setting, the function returns false, indicating an invalid setting. This prevents the redaction check from being bypassed and stops the endpoints from returning entire configuration branches containing sensitive values.",
                "generatedAt": "2026-10-19T09:21:00.388917Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "70885748c270bb21036c46d9142ef00525834a5c03669c4c4a856d7db6ef58e2",
                "patchSummary": "In app/Model/Server.php, the getSettingData() method previously checked only for the presence of a \u0027level\u0027 key before returning the setting. The patch adds a guard clause: if the resolved setting is an array (i.e., a branch/sub-tree) or lacks the \u0027level\u0027 key, the function immediately returns false. The existing logic for setting the name and resolving options is then applied only to confirmed leaf settings. This ensures callers that assumed a single-setting result never receive a multi-key branch.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "30b849102c687bb53919f1d5d20851bc20fafa4e",
                    "date": "Mon, 28 Sep 2026 12:03:56 +0200",
                    "patchSha256": "70885748c270bb21036c46d9142ef00525834a5c03669c4c4a856d7db6ef58e2",
                    "source": "https://github.com/MISP/MISP/commit/30b849102.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/30b849102.patch",
                    "subject": "fix: [settings] Server setting lookups address one setting,"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/30b849102.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "total"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T09:21:00Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [settings] Server setting lookups address one setting,",
                "tagVersionBoundary": {
                  "commits_after_fix": 11,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-200",
                    "rationale": "The settings endpoint returned sensitive configuration values (security salt, Redis passwords, plugin API keys) to a caller who requested a branch name, bypassing the intended redaction mechanism. The data was exposed to an actor who should not have had access to those specific values."
                  },
                  {
                    "cweId": "CWE-285",
                    "rationale": "The redaction check, which serves as an authorization control for sensitive setting values, was effectively bypassed because branch nodes do not carry a redacted flag. The system failed to enforce the intended access restriction on sensitive configuration data."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (30b849102c687bb53919f1d5d20851bc20fafa4e): fix: [settings] Server setting lookups address one setting,",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/30b849102.patch"
                    ],
                    "timestamp": "2026-09-28T10:03:56Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20327"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-112188",
    "datePublished": "2026-10-19T09:22:37.880Z",
    "dateReserved": "2026-10-19T09:22:31.139Z",
    "dateUpdated": "2026-10-19T09:22:37.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted