CVE-2018-6926

Name of the Vulnerable Software and Affected Versions MISP version 2.4.87

Description A server setting in MISP permitted the override of a path variable on certain Red Hat Enterprise Linux and CentOS systems, allowing site administrators to inject arbitrary OS commands. The impact is limited as the setting is only accessible to site administrators.

Recommendations For MISP version 2.4.87, consider restricting access to the server setting to prevent arbitrary OS command injection until a patch is available. As a temporary workaround, site administrators should avoid using the vulnerable setting to override path variables on Red Hat Enterprise Linux and CentOS systems where rh shell fix is enabled.