CVE-2018-12649
published 2018-06-22CVE-2018-12649: An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method…
PriorityP343critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
1.48%
70.7th percentile
An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method instead of a POST HTTP method in the login part, because this protection was only covering POST requests.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| misp-project | misp | — | — |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
MISP 2.4.92 Brute-Force Protection UsersController.php HTTP PUT Request 7pk security
vuldb·2026-06-23·CVSS 9.8
CVE-2018-12649 [CRITICAL] MISP 2.4.92 Brute-Force Protection UsersController.php HTTP PUT Request 7pk security
A vulnerability described as critical has been identified in MISP 2.4.92. This impacts an unknown function of the file app/Controller/UsersController.php of the component Brute-Force Protection. Such manipulation as part of HTTP PUT Request leads to 7pk security features.
This vulnerability is referenced as CVE-2018-12649. It is possible to launch the attack remotely. No exploit is available.
GHSA
GHSA-c6gr-mfc7-q7h7: An issue was discovered in app/Controller/UsersController
ghsa_unreviewed·2022-05-13
CVE-2018-12649 [CRITICAL] CWE-307 GHSA-c6gr-mfc7-q7h7: An issue was discovered in app/Controller/UsersController
An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method instead of a POST HTTP method in the login part, because this protection was only covering POST requests.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-06-22
Published