MISP up to 2.5.38 Correlations over-correlation Endpoint CorrelationsController.php overCorrelations input validation

Summaryinfo

A vulnerability was found in MISP up to 2.5.38 and classified as critical. This impacts the function overCorrelations of the file app/Controller/CorrelationsController.php of the component Correlations over-correlation Endpoint. Executing a manipulation can lead to input validation. The identification of this vulnerability is CVE-2026-10863. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in MISP up to 2.5.38. This vulnerability affects the function overCorrelations of the file app/Controller/CorrelationsController.php of the component Correlations over-correlation Endpoint. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value was processed by the underlying data access layer, this could allow manipulation of database query ordering and potentially expose the application to unsafe query construction. The patch removes order from the set of request-controlled parameters and instead sets the ordering server-side to occurrence desc after processing allowed user parameters. Affected component: app/Controller/CorrelationsController.php, overCorrelations() Security impact: An authenticated attacker could influence the ordering clause used by the over-correlations query. The direct impact appears limited to query manipulation unless further evidence confirms SQL injection or unauthorized data exposure through the manipulated ordering expression.

The weakness was shared by Jeroen Pinoy as aa094a335ba2855f8a42a1dc44398f43560fe247. The advisory is shared for download at github.com. This vulnerability was named CVE-2026-10863 since 06/04/2026. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are needed for exploitation. There are known technical details, but no exploit is available.

By approaching the search of inurl:app/Controller/CorrelationsController.php it is possible to find vulnerable targets with Google Hacking.

Upgrading eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• MISP

Version

• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 2.5.4
• 2.5.5
• 2.5.6
• 2.5.7
• 2.5.8
• 2.5.9
• 2.5.10
• 2.5.11
• 2.5.12
• 2.5.13
• 2.5.14
• 2.5.15
• 2.5.16
• 2.5.17
• 2.5.18
• 2.5.19
• 2.5.20
• 2.5.21
• 2.5.22
• 2.5.23
• 2.5.24
• 2.5.25
• 2.5.26
• 2.5.27
• 2.5.28
• 2.5.29
• 2.5.30
• 2.5.31
• 2.5.32
• 2.5.33
• 2.5.34
• 2.5.35
• 2.5.36
• 2.5.37
• 2.5.38

License

• open-source

Website

• Product: https://github.com/MISP/MISP/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion