CVE-2023-37306
MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can...
MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.
- Record
CVE-2023-37306- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
CVE List No score
MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.
- Record
CVE-2023-37306- Updated
- 2026-11-02
EUVDEUVD-2023-41210 No score
MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.
- Record
EUVD-2023-41210- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c2c7-4gw8-mr7w
MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can...
MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.
- Record
GHSA-c2c7-4gw8-mr7w- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSV No score
MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.
- Record
CVE-2023-37306- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-37306 is a high vulnerability (CVSS 7.5) in Misp-project Misp, published June 30, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. No source names a fixed version.
References
synacktiv.com/publications/php-filter-chains-file-read-from-error-based-oracle
github.com/MISP/MISP/commit/f125630c1c2d0f5d11079d3653ab7bb2ab5cd908
nvd.nist.gov/vuln/detail/CVE-2023-37306