Base Score

HIGH8.2

CVE-2025-66384

app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp_name.

VectorNETWORK

Published Bycve@mitre.org

Published DateNov 28, 2025, 07:15

Weakness Type (CWE):CWE-684

CVSS Metrics

Base Score

8.2

Vector String

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L

Base Severity

HIGH

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

HIGH

User Interaction (UI)

NONE

Scope (S)

CHANGED

Confidentiality (C)

LOW

Integrity (I)

HIGH

Availability (A)

LOW

References

https://github.com/MISP/MISP/compare/v2.5.23...v2.5.24
https://github.com/misp/misp/commit/6867f0d3157a1959154bdad9ddac009dec6a19f5

Base Score

HIGH8.2

Weakness Type (CWE):CWE-684

CVSS Metrics

Base Score

8.2

Vector String

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L

Base Severity

HIGH

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

HIGH

User Interaction (UI)

NONE

Scope (S)

CHANGED

Confidentiality (C)

LOW

Integrity (I)

HIGH

Availability (A)

LOW