CVE-2024-45509 in MISP
Summary
by MITRE • 09/02/2024
In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/23/2026
The vulnerability identified as CVE-2024-45509 affects the MISP (Malware Information Sharing Platform) software version 2.4.196 and earlier, representing a critical access control flaw that undermines the platform's data protection mechanisms. This issue specifically resides within the BookmarksController.php file located in the application's controller directory, where the software fails to properly enforce authorization checks for bookmark data access. The flaw manifests when users who lack organization administrator privileges attempt to access bookmark resources, creating a potential security escalation path that could allow unauthorized data exposure.
The technical implementation of this vulnerability stems from insufficient input validation and access control enforcement within the MISP application's permission model. When a user requests bookmark data through the BookmarksController, the system does not adequately verify whether the requesting user possesses the appropriate authorization levels to access the specific bookmark resources. This weakness creates a direct pathway for users to potentially view, modify, or manipulate bookmark data that should be restricted to organization administrators only, effectively bypassing the intended access controls that separate different user roles within the platform.
The operational impact of this vulnerability extends beyond simple data exposure, potentially enabling attackers to gain insights into organizational threat intelligence workflows, strategic information sharing patterns, and operational security measures. Since MISP platforms typically contain sensitive threat intelligence data, including malware signatures, indicators of compromise, and security event correlations, unauthorized access to bookmark data could reveal critical operational information. This exposure could facilitate targeted attacks against the organization's security infrastructure, enable adversaries to understand the platform's usage patterns, or provide intelligence that could be leveraged for more sophisticated attacks. The vulnerability particularly affects organizations that rely on MISP for collaborative threat intelligence sharing, where bookmark data often contains curated collections of important resources and strategic information.
Organizations utilizing MISP versions up to 2.4.196 should immediately implement mitigations to address this vulnerability, with the most effective approach being the immediate upgrade to the patched version of the software. The recommended remediation strategy includes not only the software update but also a comprehensive review of existing access control policies and user role configurations within the MISP platform. Security teams should conduct immediate audits of bookmark data access logs to identify any potential unauthorized access attempts that may have occurred during the vulnerable period. Additionally, implementing network segmentation controls and monitoring for suspicious API access patterns can provide additional layers of protection while the software upgrade is being deployed. This vulnerability aligns with CWE-285, which addresses improper authorization issues, and represents a clear violation of the principle of least privilege as outlined in various cybersecurity frameworks including the NIST Cybersecurity Framework and ISO 27001 standards. The ATT&CK framework categorizes this type of vulnerability under privilege escalation techniques, where adversaries exploit weak access controls to gain unauthorized access to restricted resources within security platforms. Organizations should also consider implementing automated patch management processes to ensure timely deployment of security updates and prevent similar vulnerabilities from emerging in other components of their security infrastructure.