CVE-2018-12649 in MISP
Summary
by MITRE
An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method instead of a POST HTTP method in the login part, because this protection was only covering POST requests.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/23/2026
The vulnerability identified as CVE-2018-12649 resides within the MISP (Malware Information Sharing Platform) version 2.4.92 authentication mechanism, specifically in the app/Controller/UsersController.php file. This flaw represents a critical security oversight that undermines the platform's defensive measures against automated login attacks. The issue manifests when an attacker exploits a method validation weakness in the authentication endpoint, allowing them to circumvent established brute-force protection mechanisms through the strategic use of HTTP PUT requests instead of the intended POST requests.
The technical implementation of this vulnerability stems from an incomplete security control that only applies brute-force protection to POST HTTP method requests while neglecting other HTTP methods such as PUT. This selective protection creates a significant attack surface where malicious actors can bypass authentication rate limiting by simply changing their request method from POST to PUT. The underlying flaw demonstrates poor input validation and method-specific access control implementation, where the system fails to properly authenticate and restrict all valid authentication methods equally. This type of vulnerability aligns with CWE-692, which describes incomplete protection mechanisms where security controls are bypassed due to insufficient coverage of all possible attack vectors.
The operational impact of this vulnerability is substantial for organizations relying on MISP for threat intelligence sharing and incident response. An attacker with knowledge of the system's authentication endpoint can systematically bypass rate limiting protections, potentially leading to successful credential stuffing attacks, password spraying attempts, or other automated login exploitation techniques. The vulnerability essentially renders the brute-force protection mechanism ineffective, exposing the system to prolonged unauthorized access attempts that could result in data breaches, privilege escalation, or complete system compromise. Organizations using MISP 2.4.92 are particularly vulnerable during periods of high threat activity when automated attack tools are actively scanning for such weaknesses.
Mitigation strategies for CVE-2018-12649 require immediate implementation of comprehensive HTTP method validation and authentication endpoint hardening. System administrators should ensure that all authentication methods are properly rate-limited and authenticated regardless of the HTTP method used, implementing a unified protection mechanism that applies to PUT, POST, and other relevant HTTP methods. The fix should involve modifying the UsersController.php file to enforce consistent authentication checks across all valid HTTP methods, applying the same brute-force protection logic to PUT requests as is currently applied to POST requests. Organizations should also consider implementing additional security controls such as IP-based rate limiting, account lockout mechanisms, and multi-factor authentication to provide layered protection. This vulnerability also highlights the importance of following ATT&CK framework principles for credential access and defense evasion techniques, where adversaries often exploit such method-specific protections to maintain persistent access to systems. The remediation process should include thorough code review to identify similar method-specific protection gaps and comprehensive testing to ensure that all authentication endpoints properly enforce security controls across all supported HTTP methods.