An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader.
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:misp-project:misp:2.4.128:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.4.128"
},
{
"last_affected": "2.4.128"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "d14ce7de709cdde3ecc9433e38e14c682894e88a"
}
],
"source": "REFERENCES_COMMIT"
}
]
}