CVE-2024-46918

MediumCVSS 4.9

Published: 15/09/2024(UTC)Updated: 22/06/2026(UTC)Translated: 23/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.44%

35th percentile - higher than 35% of all known CVEs

Summary

In MISP before version 2.4.198, the UserLoginProfilesController.php does not prevent an org admin from viewing sensitive login fields of another org admin in the same org.

Risk Assessment

The ability to expose sensitive login information between admins in the same organization poses a risk of data security breaches.

Recommendation

It is recommended to upgrade MISP to version 2.4.198 or later to mitigate this vulnerability.

Original NVD description (English source)

app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in the same org.