{"id":"CVE-2020-11458","title":"app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP","summary":"app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP. This does not cause a leak of the full contents of a file, but does cause a leaks of strings that match certain pa…","severity":"medium","cvss":4.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","vendor":"misp-project","product":"misp","affected":["misp < 2.4.124"],"patched":["misp 2.4.124"],"published":"2020-04-02","updated":"2026-06-22","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-11458","references":[{"url":"https://github.com/MISP/MISP/commit/30ff4b6451549dae7b526d4fb3a49061311ed477","label":"cve@mitre.org"},{"url":"https://matthias.sdfeu.org/misp-poc.py","label":"cve@mitre.org"},{"url":"https://github.com/MISP/MISP/commit/30ff4b6451549dae7b526d4fb3a49061311ed477","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://matthias.sdfeu.org/misp-poc.py","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.01118,"epssPercentile":0.6467,"ingestedAt":"2026-06-29T13:24:33.455Z","slug":"CVE-2020-11458","body":"## Overview\n\napp/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP. This does not cause a leak of the full contents of a file, but does cause a leaks of strings that match certain patterns. Among the data that can leak are passwords from database.php or GPG key passphrases from config.php.\n\n## Affected\n\n- `misp < 2.4.124`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `misp 2.4.124`","depth":"sunlit","depthScore":27,"depthScoreParts":{"impact":27,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}