What is CVE-2017-14337?

CVE-2017-14337 is a high-severity vulnerability in Misp-Project Misp, classified under Improper Authentication. CVSS score: 8.1/10. Published 2017-09-12.

How severe is CVE-2017-14337?

High severity. CVSS v3 base score is 8.1 out of 10.

Auth bypass in Misp-Project Misp

CVE-2017-14337

When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate authentication and this API returns an empty value, the unauthenticated user can be granted access as an arbitrary user.

Vulnerability class: Broken Authentication

EPSS: 0.009 (56.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Misp-project Misp
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)
cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)

Frequently asked questions

What is CVE-2017-14337?: CVE-2017-14337 is a high-severity vulnerability in Misp-Project Misp, classified under Improper Authentication. CVSS score: 8.1/10. Published 2017-09-12.
How severe is CVE-2017-14337?: High severity. CVSS v3 base score is 8.1 out of 10.