CVE-2021-25323
on github
Published
Severity
CVSS v3:
9.1 CRITICAL
CVSS v2:
6.4 MEDIUM
Description
The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password when changing a password.
References
Configurations
CPE23 | Version Start | Version End | Exact Version |
---|---|---|---|
cpe:2.3:a:misp:misp:2.4.136:*:*:*:*:*:*:* | n/a | n/a | 2.4.136 |