GHSA-j4rh-7jcr-qm69

Source

https://github.com/advisories/GHSA-j4rh-7jcr-qm69

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j4rh-7jcr-qm69/GHSA-j4rh-7jcr-qm69.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-j4rh-7jcr-qm69

Aliases

CVE-2026-44364

Published

2026-05-06T22:31:39Z

Modified

2026-05-14T20:51:21.051903Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H CVSS Calculator

Summary

misp-modules website - Missing CSRF protection in the website home blueprint

Details

A Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of session query data in the context of the authenticated user. The issue was fixed by enabling CSRF protection for the affected blueprint and hardening query parsing. As reported by Bilal Teke.

Database specific

{
    "github_reviewed_at": "2026-05-06T22:31:39Z",
    "nvd_published_at": "2026-05-13T20:16:23Z",
    "cwe_ids": [
        "CWE-352"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true
}

References

Affected packages

PyPI / misp-modules

Package

Name: misp-modules; View open source insights on deps.dev
Purl: pkg:pypi/misp-modules

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

3.0.7

Affected versions

2.*

2.4.196

2.4.197

2.4.198

2.4.199

2.4.200

2.4.201

3.*

3.0.0

3.0.1

3.0.2

3.0.4

3.0.5

3.0.6

3.0.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j4rh-7jcr-qm69/GHSA-j4rh-7jcr-qm69.json"