CVE-2022-48329

MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model...

9.8 Critical

MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.94%Unchanged since Feb 20, 2023

What each source reports

NVD Score used9.8

Record: CVE-2022-48329
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-755
Updated: 2026-11-02

CVE List9.8

Record: CVE-2022-48329
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-755
Updated: 2026-11-02

EUVDEUVD-2022-510299.8

Record: EUVD-2022-51029
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-65hj-59g8-fjjc9.8

MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model...

Record: GHSA-65hj-59g8-fjjc
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-755
Updated: 2026-11-02

OSV9.8

Record: CVE-2022-48329
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

misp-project misp

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-48329 is a critical vulnerability (CVSS 9.8) in Misp-project Misp, published February 20, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.94%, the 61st percentile. No source names a fixed version.