CVE-2026-44381 Details
Description
MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled ordering parameters in the event and shadow attribute listing endpoints. The affected code accepted order or sort values from request parameters and incorporated them into database query ordering clauses without sufficient validation of the requested field name. An attacker with access to the affected endpoints could craft a malicious ordering parameter to manipulate the generated SQL query. Depending on database permissions and query context, this could potentially allow unauthorized access to data, modification of query behavior, or other database-level impact. This vulnerability is fixed in 2.5.37.
A SQL injection vulnerability has been identified in MISP versions prior to 2.5.37. The issue arises in the event and shadow attribute listing endpoints, where user-controlled ordering parameters are not properly validated before being incorporated into database query ordering clauses. This flaw allows an attacker with access to these endpoints to manipulate the SQL query by crafting a malicious ordering parameter. Depending on the database permissions and query context, this could lead to unauthorized data access, modification of query behavior, or other database-level impacts.
Users can upgrade to MISP version 2.5.37 or later to address this vulnerability. The patched version removes direct use of user-supplied order parameters, validates ordering fields against allowed model fields or schemas, and constructs order clauses using only validated field names and normalized sort directions.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MISP/MISP/security/advisories/GHSA-4cxp-22wm-j6jr | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| misp-project misp | < 2.5.37 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CPE Deprecation Remap | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |