CVE Vulnerabilities

CVE-2024-29858

Incomplete Identification of Uploaded File Variables (PHP)

Published: Mar 21, 2024 | Modified: Jun 17, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu
root.io minimus.io echohq.com

In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.

Weakness

The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files.

Affected Software

Name Vendor Start Version End Version
Misp Misp * 2.4.187 (excluding)

Potential Mitigations

References