CVE-2017-14337

{"id": "CVE-2017-14337", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2017-09-12T16:29:00.177", "references": [{"url": "https://github.com/MISP/MISP/commit/be111a470204a974c50682054c9c7d4b94396ed9", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.circl.lu/advisory/CVE-2017-14337/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate authentication and this API returns an empty value, the unauthenticated user can be granted access as an arbitrary user."}, {"lang": "es", "value": "Cuando MISP en versiones anteriores a la 2.4.80 se configura con la autenticaci\u00f3n del certificado X.509 (CertAuth) conjuntamente con una API ReST de gesti\u00f3n de usuarios externos no perteneciente a MISP, si un usuario externo proporciona una autenticaci\u00f3n de certificado X.509 y esta API devuelve un valor vac\u00edo, el usuario sin autenticar puede obtener acceso como un usuario arbitrario."}], "lastModified": "2017-09-29T15:11:21.843", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04F9B0DC-899B-4F57-8CF8-A7B78062D1E9", "versionEndIncluding": "2.4.79"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}