hitoshura25/cvefixes huggingface dataset:
CVE-2020-8891 (PHP, published 2020-02-12T00:15Z)
Description: value: An issue was discovered in MISP before 2.4.121. It did not canonicalize usernames when trying to block a brute-force series of invalid requests.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/UsersController.php
app/Model/Bruteforce.php
Commit message: fix: [security] Further fixes to the bruteforce handling

- resolved a potential failure of the subsystem when the MySQL and the webserver time settings are diverged
  - as reported by Dawid Czarnecki
- several tightenings of the checks to avoid potential foul play


Vulnerable code:
            if ($this->request->is('post')) {
        $expire = time() + Configure::read('SecureAuth.expire');
            'username' => $username,
            $title .= 'This has tripped the bruteforce protection after  ' . Configure::read('SecureAuth.amount') . ' failed attempts. The user is now blacklisted for ' . Configure::read('SecureAuth.expire') . ' seconds.';
            $sql = 'DELETE FROM bruteforces WHERE `expire` <= NOW();';
            $sql = 'DELETE FROM bruteforces WHERE expire <= NOW();';

Fixed code:
                    $expire = Configure::check('SecureAuth.expire') ? Configure::read('SecureAuth.expire') : 300;
            if ($this->request->is('post') || $this->request->is('put')) {
        $expire = Configure::check('SecureAuth.expire') ? Configure::read('SecureAuth.expire') : 300;
        $amount = Configure::check('SecureAuth.amount') ? Configure::read('SecureAuth.amount') : 5;
        $expire = time() + $expire;
            'username' => trim(strtolower($username)),
            $title .= 'This has tripped the bruteforce protection after  ' . $amount . ' failed attempts. The user is now blacklisted for ' . $expire . ' seconds.';
        $expire = date('Y-m-d H:i:s', time());
            $sql = 'DELETE FROM bruteforces WHERE `expire` <= "' . $expire . '";';
            $sql = 'DELETE FROM bruteforces WHERE expire <= "' . $expire . '";';
CVE-2020-8891 (PHP, published 2020-02-12T00:15Z)
Description: value: An issue was discovered in MISP before 2.4.121. It did not canonicalize usernames when trying to block a brute-force series of invalid requests.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/Model/Bruteforce.php
Commit message: fix: [security] brutefoce protection rules tightened

- as reported by Dawid Czarnecki


Vulnerable code:
        $params = array('conditions' => array(
                        'Bruteforce.ip' => $ip,
                        'Bruteforce.username' => $username),);
        if ($count >= Configure::read('SecureAuth.amount')) {

Fixed code:
        $params = array(
            'conditions' => array(
            'Bruteforce.ip' => $ip,
            'LOWER(Bruteforce.username)' => trim(strtolower($username)))
        );
        $amount = Configure::check('SecureAuth.amount') ? Configure::read('SecureAuth.amount') : 5;
        if ($count >= $amount) {
CVE-2020-8892 (PHP, published 2020-02-12T00:15Z)
Description: value: An issue was discovered in MISP before 2.4.121. It did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/UsersController.php
app/Model/Bruteforce.php
Commit message: fix: [security] Further fixes to the bruteforce handling

- resolved a potential failure of the subsystem when the MySQL and the webserver time settings are diverged
  - as reported by Dawid Czarnecki
- several tightenings of the checks to avoid potential foul play


Vulnerable code:
            if ($this->request->is('post')) {
        $expire = time() + Configure::read('SecureAuth.expire');
            'username' => $username,
            $title .= 'This has tripped the bruteforce protection after  ' . Configure::read('SecureAuth.amount') . ' failed attempts. The user is now blacklisted for ' . Configure::read('SecureAuth.expire') . ' seconds.';
            $sql = 'DELETE FROM bruteforces WHERE `expire` <= NOW();';
            $sql = 'DELETE FROM bruteforces WHERE expire <= NOW();';

Fixed code:
                    $expire = Configure::check('SecureAuth.expire') ? Configure::read('SecureAuth.expire') : 300;
            if ($this->request->is('post') || $this->request->is('put')) {
        $expire = Configure::check('SecureAuth.expire') ? Configure::read('SecureAuth.expire') : 300;
        $amount = Configure::check('SecureAuth.amount') ? Configure::read('SecureAuth.amount') : 5;
        $expire = time() + $expire;
            'username' => trim(strtolower($username)),
            $title .= 'This has tripped the bruteforce protection after  ' . $amount . ' failed attempts. The user is now blacklisted for ' . $expire . ' seconds.';
        $expire = date('Y-m-d H:i:s', time());
            $sql = 'DELETE FROM bruteforces WHERE `expire` <= "' . $expire . '";';
            $sql = 'DELETE FROM bruteforces WHERE expire <= "' . $expire . '";';
CVE-2020-8892 (PHP, published 2020-02-12T00:15Z)
Description: value: An issue was discovered in MISP before 2.4.121. It did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/Model/Bruteforce.php
Commit message: fix: [security] brutefoce protection rules tightened

- as reported by Dawid Czarnecki


Vulnerable code:
        $params = array('conditions' => array(
                        'Bruteforce.ip' => $ip,
                        'Bruteforce.username' => $username),);
        if ($count >= Configure::read('SecureAuth.amount')) {

Fixed code:
        $params = array(
            'conditions' => array(
            'Bruteforce.ip' => $ip,
            'LOWER(Bruteforce.username)' => trim(strtolower($username)))
        );
        $amount = Configure::check('SecureAuth.amount') ? Configure::read('SecureAuth.amount') : 5;
        if ($count >= $amount) {
CVE-2020-8893 (Other, published 2020-02-12T00:15Z)
Description: value: An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in app/View/Galaxies/view.ctp.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Galaxies/view.ctp
Commit message: fix: [security] Correctly sanitize search string in Galaxy view

- As reported by Dawid Czarnecki


Vulnerable code:
    $.get("<?php echo $uri;?>", function(data) {

Fixed code:
    $.get("<?php echo h($uri);?>", function(data) {
CVE-2021-25323 (PHP, published 2021-01-19T16:15Z)
Description: value: The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password when changing a password.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-640 \u2014 Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Repository: https://github.com/MISP/MISP
Files changed:
app/Config/config.default.php
Commit message: fix: [security] Require password confirmations by default

- the setting is optional, but the default should be that it's required unless disabled

- As reported by Patrix Kontura from ESET


Vulnerable code:

Fixed code:
            'require_password_confirmation' => true
CVE-2021-25324 (Other, published 2021-01-19T16:15Z)
Description: value: MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/GalaxyClusters/view.ctp
Commit message: fix: [security] Stored XSS in the galaxy cluster view

- Galaxy cluster names were vulnerable to XSS injection

- As reported by Patrik Kontura of ESET


Vulnerable code:
        'key' => __('Owner Organisation'), 
        'key' => __('Creator Organisation'), 
    $table_data[] = array('key' => __('Events'), 'html' => isset($cluster['GalaxyCluster']['tag_count']) ? 
                <?= sprintf('%s :: %s', h($cluster['GalaxyCluster']['Galaxy']['name']), $cluster['GalaxyCluster']['value']); ?>

Fixed code:
        'key' => __('Owner Organisation'),
        'key' => __('Creator Organisation'),
    $table_data[] = array('key' => __('Events'), 'html' => isset($cluster['GalaxyCluster']['tag_count']) ?
                <?= sprintf('%s :: %s', h($cluster['GalaxyCluster']['Galaxy']['name']), h($cluster['GalaxyCluster']['value'])); ?>
CVE-2021-25325 (Other, published 2021-01-19T16:15Z)
Description: value: MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/GalaxyElements/ajax/index.ctp
Commit message: fix: [security] XSS via galaxy cluster element values for reference types could contain javascript links

- ref type elements are automatically converted to links. A user would have to click a javascript: link for it to trigger, it's still too risky to keep as is
- only urls starting with http:// and https:// are converted from here on

- As reported by Patrik Kontura from ESET


Vulnerable code:
        
            <td class="short"><?php if ($item['GalaxyElement']['key'] === 'refs') {
        endforeach; 

Fixed code:

            <td class="short">
            <?php if (
                $item['GalaxyElement']['key'] === 'refs' &&
                (
                    substr($item['GalaxyElement']['value'], 0, 8) === 'https://' ||
                    substr($item['GalaxyElement']['value'], 0, 7) === 'http://'
                )
            ) {
        endforeach;
CVE-2021-27904 (PHP, published 2021-03-02T07:15Z)
Description: value: An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139. In the implementation of Sharing Groups, the "all org" flag sometimes provided view access to unintended actors.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/Model/SharingGroupServer.php
Commit message: fix: [security] sharing group all org flag too lax

- the all org flag was used as a trigger to make the sharing group obejct itself viewable to all local organisations
- even if the all org flag was set for an instance other than the local one

- as reported by Jeroen Pinoy


Vulnerable code:
                'conditions' => array('sharing_group_id' => $id, 'all_orgs' => 1),

Fixed code:
                'conditions' => array('sharing_group_id' => $id, 'all_orgs' => 1, 'server_id' => 0),
CVE-2021-31780 (PHP, published 2021-04-23T20:15Z)
Description: value: In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit. When an object has a sharing group associated with an event edit, the sharing group object is ignored and instead the passed local ID is reused.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-212 \u2014 Improper Removal of Sensitive Information Before Storage or Transfer
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
Repository: https://github.com/MISP/MISP
Files changed:
app/Model/MispObject.php
Commit message: fix: [security] Sharing group misassociation on sync

- when an object has a sharing group associated on an event edit, the sharing group object is ignored and instead the passed local ID is reused
- as reported by Jeroen Pinoy


Vulnerable code:
                            'model' => 'Object',

Fixed code:
        if (isset($object['distribution']) && $object['distribution'] == 4) {
            if (!empty($object['SharingGroup'])) {
                $object['sharing_group_id'] = $this->SharingGroup->captureSG($object['SharingGroup'], $user);
            } elseif (!empty($object['sharing_group_id'])) {
                if (!$this->SharingGroup->checkIfAuthorised($user, $object['sharing_group_id'])) {
                    unset($object['sharing_group_id']);
                }
            }
            if (empty($object['sharing_group_id'])) {
                $object_short = (isset($object['meta-category']) ? $object['meta-category'] : 'N/A') . '/' . (isset($object['name']) ? $object['name'] : 'N/A') . ' ' . (isset($object['uuid']) ? $object['uuid'] : 'N/A');
                $this->Log = ClassRegistry::init('Log');
                $this->Log->create();
                $this->Log->save(array(
                    'org' => $user['Organisation']['name'],
                    'model' => 'MispObject',
                    'model_id' => 0,
                    'email' => $user['email'],
                    'action' => 'edit',
                    'user_id' => $user['id'],
                    'title' => 'Object dropped due to invalid sharing group for Event ' . $eventId . ' failed: ' . $object_short,
                    'change' => 'Validation errors: ' . json_encode($this->validationErrors) . ' Full Object: ' . json_encode($object),
                ));
                return 'Invalid sharing group choice.';
            }
        }
                            'model' => 'MispObject',
CVE-2021-3184 (Other, published 2021-01-19T16:15Z)
Description: value: MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Elements/global_menu.ctp
Commit message: fix: [security] XSS in the user homepage favourite button

- navigating to a url in MISP with the URL containing a javascript payload would cause the execution of reflected xss
- automatically sanitised by modern browsers, but still confirmed via raw curl fetches


Vulnerable code:
                    $this->here

Fixed code:
                    h($this->here)
CVE-2021-35502 (Other, published 2021-06-25T21:15Z)
Description: value: app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp
Commit message: security: [generic-template:index] Fixed unsanitized input


Vulnerable code:
                $data = $data[0];

Fixed code:
                $data = h($data[0]);
CVE-2021-36212 (Other, published 2021-07-07T13:15Z)
Description: value: app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/SharingGroups/view.ctp
Commit message: security: fix stored xss in sharing groups view as reported by Nicolas Vidal from TEHTRIS.


Vulnerable code:
<h2><?= __('Sharing Group %s', $sg['SharingGroup']['name']);?></h2>

Fixed code:
<h2><?= __('Sharing Group %s', h($sg['SharingGroup']['name']));?></h2>
CVE-2021-37534 (Other, published 2021-07-26T14:15Z)
Description: value: app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/GalaxyClusters/add.ctp
Commit message: fix: [security] Stored XSS when forking a galaxy cluster
As reported by Giuseppe Diego Gianni


Vulnerable code:
                $forkedClusterHtmlPreview .= sprintf('<div><b>%s: </b><div data-toggle="json" class="large-left-margin">%s</div></div>', h($key), json_encode($value));

Fixed code:
                $forkedClusterHtmlPreview .= sprintf('<div><b>%s: </b><div data-toggle="json" class="large-left-margin">%s</div></div>', h($key), json_encode(h($value)));
CVE-2021-37742 (Other, published 2021-07-30T15:15Z)
Description: value: app/View/Elements/GalaxyClusters/view_relation_tree.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster relationships.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Elements/GalaxyClusters/view_relation_tree.ctp
Commit message: fix: [security] Stored XSS when viewing galaxy cluster relationships
- As reported by Dawid Czarnecki


Vulnerable code:
            .html(function(d) { return d.Relation.referenced_galaxy_cluster_type; })
                            .html(tag.name)

Fixed code:
            .text(function(d) { return d.Relation.referenced_galaxy_cluster_type; })
                            .text(tag.name)
CVE-2021-37743 (Other, published 2021-07-30T15:15Z)
Description: value: app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/GalaxyElements/ajax/index.ctp
Commit message: fix: [security] Stored XSS when viewing galaxy cluster elements in JSON format


Vulnerable code:
    echo sprintf('<div id="elementJSONDiv" class="well well-small">%s</div>', json_encode($JSONElements));

Fixed code:
    echo sprintf('<div id="elementJSONDiv" class="well well-small">%s</div>', json_encode(h($JSONElements)));
CVE-2021-39302 (PHP, published 2021-08-19T17:15Z)
Description: value: MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/MISP/MISP
Files changed:
app/Model/Log.php
Commit message: security: fix unescaped parameter leading to sqli


Vulnerable code:
                $condOrg = ' AND org = "' . $conditions['org'] . '"';

Fixed code:
                $condOrg = sprintf('AND org = %s', $this->getDataSource()->value($conditions['org']));
CVE-2022-27243 (Other, published 2022-03-18T18:15Z)
Description: value: An issue was discovered in MISP before 2.4.156. app/View/Users/terms.ctp allows Local File Inclusion via the custom terms file setting.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Users/terms.ctp
Commit message: fix: [security] lfi via custom terms file setting, as reported by Ianis BERNARD - NATO Cyber Security Centre


Vulnerable code:
        $termsFile = APP . 'files' . DS . 'terms' . DS . Configure::read('MISP.terms_file');

Fixed code:
        $customTermsFile = basename(realpath(Configure::read('MISP.terms_file')));
        $termsFile = APP . 'files' . DS . 'terms' . DS . $customTermsFile;
CVE-2022-27244 (Other, published 2022-03-18T18:15Z)
Description: value: An issue was discovered in MISP before 2.4.156. A malicious site administrator could store an XSS payload in the custom auth name. This would be executed each time the administrator modifies a user.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Users/admin_add.ctp
app/View/Users/admin_edit.ctp
Commit message: fix: [security] stored XSS in the user add/edit forms

- a malicious site administrator could store an XSS payload in the custom auth name which would be executed each time the administrator modifies a user

- as reported by Ianis BERNARD - NATO Cyber Security Centre


Vulnerable code:
                echo $this->Form->input('external_auth_required', array('type' => 'checkbox', 'label' => $userType . ' user'));
                echo $this->Form->input('external_auth_required', array('type' => 'checkbox', 'label' => $userType . ' user'));

Fixed code:
                echo $this->Form->input('external_auth_required', array('type' => 'checkbox', 'label' => h($userType) . ' user'));
                echo $this->Form->input('external_auth_required', array('type' => 'checkbox', 'label' => h($userType) . ' user'));