GCVE-1-2026-20257 (CVE-2026-103659)

Vulnerability from gna-1 – Published: 2026-10-01 08:32 – Updated: 2026-10-01 08:33
VLAI
Title
MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes
Summary
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distribution and sharing-group access control check was not re-applied to those attributes. As a result, a user who can view a community-distributed event could retrieve attributes belonging to organisation-only objects (distribution level 0) or objects restricted to a specific sharing group, even though the user's organisation does not have access to those objects. This constitutes an unauthorized disclosure of sensitive threat intelligence data. A secondary issue was introduced by the initial remediation: the fix reused the full Object contain conditions (including soft-delete state) as the gate for flattened attributes, causing an event owner requesting deleted attributes to lose all attributes whose parent object was still live. The final fix isolates the distribution ACL condition as the sole gate. Preconditions: - An authenticated user with access to a community-distributed event - The event contains at least one object with a distribution level or sharing group that restricts access beyond the event's own distribution Impact: - Unauthorized disclosure of attributes belonging to restricted objects - Potential exposure of organisation-specific threat intelligence to other organisations Affected versions: <2.5.48
Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
Supplier · CNA (v2.0.3)
Decision recorded 2026-10-01 08:10 UTC
CWE
Assigner
GNA-1 This instance Scorecard
References
Impacted products
Vendor Product Version CPE status
MISP MISP Affected: 0 , < 2.5.48 (semver)
    cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Wenhao Wu iglocska Claude Opus 4.8 Claude Opus 5
GCVE extensions
bcp-05-x-01
AI-assisted vulnerability information annotation
GCVE-BCP-05-X-01
Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
bcp-05-x-02
Patch-to-vulnerability generation provenance
GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-10-01 08:10
Model
qwen3.8:27b
Input
patch set (2 sources) e74b42214be0…
Confidence
medium
Commit Subject Patch SHA-256
ab08edf9256b fix: [security] Apply the object ACL to flattened attributes ebc10168f16d…
07f3486d50f2 fix: [event] Gate flattened attributes on the object ACL 18601512c29d…
Fix summary

The fix re-applies the object distribution and sharing-group ACL as a subquery condition on the Attribute.object_id field whenever the flatten option is active. This ensures that attributes belonging to objects the caller is not authorized to see are excluded from the flattened result set. The second commit refines the gate to use only the distribution ACL condition (correlated on Object.id) rather than the entire Object contain, preventing soft-delete state from incorrectly filtering attributes for the event owner.

Patch summary

In app/Model/Event.php, two code paths were modified. In fetchPaginatedAttributes(), a new subquery is generated against the Object table using the distribution and sharing-group ACL conditions, and an OR condition is added to the attribute query: either Attribute.object_id = 0 (top-level attribute) or the attribute's object passes the ACL. In fetchEvent(), when flatten is true and the user is not a site admin, a similar subquery is injected into the Attribute contain conditions. The second commit refactors the ACL condition into a standalone variable ($objectAclCondition) and uses only that condition (plus Object.id = Attribute.object_id) in the subquery, removing the soft-delete and other contain conditions that were incorrectly included. A regression test class (FlattenedObjectAcl) in tests/testregressions.py verifies: (1) an outsider cannot see organisation-only object attributes via flatten, (2) the owner retains soft-deleted attributes of a live object, and (3) the outsider cannot see another org's soft

CVSS rationale

AV:N - exploited over the network via the MISP REST API. AC:L - the attack is a simple API request with the flatten parameter; no race conditions or complex setup required. AT:N - no special target-side conditions beyond the existence of a community event with restricted objects. PR:L - requires an authenticated user with at least read access to the community event. UI:N - no user interaction needed; the API call is self-contained. VC:H - sensitive threat-intelligence attributes from organisation-only objects are fully exposed to unauthorized users. VI:N, VA:N - no integrity or availability impact on the vulnerable component. SC:N, SI:N, SA:N - no impact on subsequent components; the data resides within the same application.

Weakness rationale
  • CWE-862 The flattening code path removed the Object contain (which enforced distribution and sharing-group ACLs) without re-applying an equivalent authorization check on the resulting top-level attributes. The object-level access control was simply absent from the flattened query, allowing unauthorized data access.
  • CWE-285 The authorization decision for object attributes was based solely on the event-level distribution rather than the object-level distribution and sharing group. This is an improper authorization check that grants broader access than intended.
Attack pattern rationale
  • CAPEC-126 The attacker (a legitimate user with access to a community event) exploits the fact that the application's privilege/access-control enforcement is incorrectly adjusted during the flatten operation. The object-level ACL is not applied, effectively elevating the user's data access beyond their intended scope. This is the closest CAPEC pattern to an authorization bypass where the application fails to enforce a narrower access control in a specific code path. Uncertainty: no CAPEC pattern specifically describes 'missing per-object ACL in a flattened view'; CAPEC-126 is the best available match for privilege/access-control bypass.
Assumptions to verify
  • The affected version range is unspecified; the patch does not include version tags or release boundaries. All MISP versions prior to the fix commit are assumed affected.
  • The CVSS PR:L assumes the attacker needs at minimum a read-access role on the community event; no evidence supports a lower or higher privilege requirement.
  • The CAPEC-126 mapping is the closest available pattern; no CAPEC specifically describes a missing per-object ACL in a flattened API response. The mapping is approximate.
  • The second commit (soft-delete fix) is treated as part of the same vulnerability remediation per the patch-set assumption, though it addresses a regression introduced by the first fix rather than the original authorization bypass.
  • AI co-authors (Claude Opus 4.8, Claude Opus 5) are listed in commit metadata but are not included as advisory credits as they are tooling, not human contributors.
  • No evidence of active exploitation, public PoC, or in-the-wild abuse was found in the supplied data.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 6 11 medium 6
bcp-05-x-03
Vulnerability handling and disclosure timeline
GCVE-BCP-05-X-03
  1. 2026-09-23 07:25 UTC Fix developed Corrective change authored (ab08edf9256bb3c9c8a382e0778ecd10b9e29c7c): fix: [security] Apply the object ACL to flattened attributes
  2. 2026-09-28 11:41 UTC Fix developed Corrective change authored (07f3486d50f2a5ee0f31ea66c920692664397ddb): fix: [event] Gate flattened attributes on the object ACL
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Event model (app/Model/Event.php)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Wenhao Wu"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distribution and sharing-group access control check was not re-applied to those attributes.\u003c/p\u003e\u003cp\u003eAs a result, a user who can view a community-distributed event could retrieve attributes belonging to organisation-only objects (distribution level 0) or objects restricted to a specific sharing group, even though the user\u0027s organisation does not have access to those objects. This constitutes an unauthorized disclosure of sensitive threat intelligence data.\u003c/p\u003e\u003cp\u003eA secondary issue was introduced by the initial remediation: the fix reused the full Object contain conditions (including soft-delete state) as the gate for flattened attributes, causing an event owner requesting deleted attributes to lose all attributes whose parent object was still live. The final fix isolates the distribution ACL condition as the sole gate.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated user with access to a community-distributed event\u003c/p\u003e\u003cp\u003e- The event contains at least one object with a distribution level or sharing group that restricts access beyond the event\u0027s own distribution\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Unauthorized disclosure of attributes belonging to restricted objects\u003c/p\u003e\u003cp\u003e- Potential exposure of organisation-specific threat intelligence to other organisations\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distribution and sharing-group access control check was not re-applied to those attributes.\n\nAs a result, a user who can view a community-distributed event could retrieve attributes belonging to organisation-only objects (distribution level 0) or objects restricted to a specific sharing group, even though the user\u0027s organisation does not have access to those objects. This constitutes an unauthorized disclosure of sensitive threat intelligence data.\n\nA secondary issue was introduced by the initial remediation: the fix reused the full Object contain conditions (including soft-delete state) as the gate for flattened attributes, causing an event owner requesting deleted attributes to lose all attributes whose parent object was still live. The final fix isolates the distribution ACL condition as the sole gate.\n\nPreconditions:\n\n- An authenticated user with access to a community-distributed event\n\n- The event contains at least one object with a distribution level or sharing group that restricts access beyond the event\u0027s own distribution\n\nImpact:\n\n- Unauthorized disclosure of attributes belonging to restricted objects\n\n- Potential exposure of organisation-specific threat intelligence to other organisations\n\nAffected versions: \u003c2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Exploiting Incorrectly Adjusted Privileges"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-01T08:10:59Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/ab08edf92"
        },
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/07f3486d5"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix re-applies the object distribution and sharing-group ACL as a subquery condition on the Attribute.object_id field whenever the flatten option is active. This ensures that attributes belonging to objects the caller is not authorized to see are excluded from the flattened result set. The second commit refines the gate to use only the distribution ACL condition (correlated on Object.id) rather than the entire Object contain, preventing soft-delete state from incorrectly filtering attributes for the event owner.\u003c/p\u003e"
            }
          ],
          "value": "The fix re-applies the object distribution and sharing-group ACL as a subquery condition on the Attribute.object_id field whenever the flatten option is active. This ensures that attributes belonging to objects the caller is not authorized to see are excluded from the flattened result set. The second commit refines the gate to use only the distribution ACL condition (correlated on Object.id) rather than the entire Object contain, preventing soft-delete state from incorrectly filtering attributes for the event owner."
        }
      ],
      "title": "MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is unspecified; the patch does not include version tags or release boundaries. All MISP versions prior to the fix commit are assumed affected.",
                  "The CVSS PR:L assumes the attacker needs at minimum a read-access role on the community event; no evidence supports a lower or higher privilege requirement.",
                  "The CAPEC-126 mapping is the closest available pattern; no CAPEC specifically describes a missing per-object ACL in a flattened API response. The mapping is approximate.",
                  "The second commit (soft-delete fix) is treated as part of the same vulnerability remediation per the patch-set assumption, though it addresses a regression introduced by the first fix rather than the original authorization bypass.",
                  "AI co-authors (Claude Opus 4.8, Claude Opus 5) are listed in commit metadata but are not included as advisory credits as they are tooling, not human contributors.",
                  "No evidence of active exploitation, public PoC, or in-the-wild abuse was found in the supplied data."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The attacker (a legitimate user with access to a community event) exploits the fact that the application\u0027s privilege/access-control enforcement is incorrectly adjusted during the flatten operation. The object-level ACL is not applied, effectively elevating the user\u0027s data access beyond their intended scope. This is the closest CAPEC pattern to an authorization bypass where the application fails to enforce a narrower access control in a specific code path. Uncertainty: no CAPEC pattern specifically describes \u0027missing per-object ACL in a flattened view\u0027; CAPEC-126 is the best available match for privilege/access-control bypass."
                  }
                ],
                "commit": "07f3486d50f2a5ee0f31ea66c920692664397ddb",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Wenhao Wu"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5"
                  }
                ],
                "cvssRationale": "AV:N - exploited over the network via the MISP REST API. AC:L - the attack is a simple API request with the flatten parameter; no race conditions or complex setup required. AT:N - no special target-side conditions beyond the existence of a community event with restricted objects. PR:L - requires an authenticated user with at least read access to the community event. UI:N - no user interaction needed; the API call is self-contained. VC:H - sensitive threat-intelligence attributes from organisation-only objects are fully exposed to unauthorized users. VI:N, VA:N - no integrity or availability impact on the vulnerable component. SC:N, SI:N, SA:N - no impact on subsequent components; the data resides within the same application.",
                "fixSummary": "The fix re-applies the object distribution and sharing-group ACL as a subquery condition on the Attribute.object_id field whenever the flatten option is active. This ensures that attributes belonging to objects the caller is not authorized to see are excluded from the flattened result set. The second commit refines the gate to use only the distribution ACL condition (correlated on Object.id) rather than the entire Object contain, preventing soft-delete state from incorrectly filtering attributes for the event owner.",
                "generatedAt": "2026-10-01T08:10:59.855811Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "e74b42214be094a3c715d859dd20b9ecd7091d30a187ab4583a7ec0f070c0581",
                "patchSummary": "In app/Model/Event.php, two code paths were modified. In fetchPaginatedAttributes(), a new subquery is generated against the Object table using the distribution and sharing-group ACL conditions, and an OR condition is added to the attribute query: either Attribute.object_id = 0 (top-level attribute) or the attribute\u0027s object passes the ACL. In fetchEvent(), when flatten is true and the user is not a site admin, a similar subquery is injected into the Attribute contain conditions. The second commit refactors the ACL condition into a standalone variable ($objectAclCondition) and uses only that condition (plus Object.id = Attribute.object_id) in the subquery, removing the soft-delete and other contain conditions that were incorrectly included. A regression test class (FlattenedObjectAcl) in tests/testregressions.py verifies: (1) an outsider cannot see organisation-only object attributes via flatten, (2) the owner retains soft-deleted attributes of a live object, and (3) the outsider cannot see another org\u0027s soft",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "ab08edf9256bb3c9c8a382e0778ecd10b9e29c7c",
                    "date": "Wed, 23 Sep 2026 09:25:31 +0200",
                    "patchSha256": "ebc10168f16d00a458d924a62fe76e00277217c8449c694eeb4442d6d3a724a0",
                    "source": "https://github.com/MISP/MISP/commit/ab08edf92.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/ab08edf92.patch",
                    "subject": "fix: [security] Apply the object ACL to flattened attributes"
                  },
                  {
                    "commit": "07f3486d50f2a5ee0f31ea66c920692664397ddb",
                    "date": "Mon, 28 Sep 2026 13:41:23 +0200",
                    "patchSha256": "18601512c29df510bfdc629de713cffd41af868e7d230374aa346c92829e40de",
                    "source": "https://github.com/MISP/MISP/commit/07f3486d5.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/07f3486d5.patch",
                    "subject": "fix: [event] Gate flattened attributes on the object ACL"
                  }
                ],
                "source": "patch set (2 sources)",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-01T08:10:59Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [event] Gate flattened attributes on the object ACL",
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The flattening code path removed the Object contain (which enforced distribution and sharing-group ACLs) without re-applying an equivalent authorization check on the resulting top-level attributes. The object-level access control was simply absent from the flattened query, allowing unauthorized data access."
                  },
                  {
                    "cweId": "CWE-285",
                    "rationale": "The authorization decision for object attributes was based solely on the event-level distribution rather than the object-level distribution and sharing group. This is an improper authorization check that grants broader access than intended."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (ab08edf9256bb3c9c8a382e0778ecd10b9e29c7c): fix: [security] Apply the object ACL to flattened attributes",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/ab08edf92.patch"
                    ],
                    "timestamp": "2026-09-23T07:25:31Z",
                    "type": "fix-developed"
                  },
                  {
                    "description": "Corrective change authored (07f3486d50f2a5ee0f31ea66c920692664397ddb): fix: [event] Gate flattened attributes on the object ACL",
                    "id": "evt-fix-developed-2",
                    "references": [
                      "https://github.com/MISP/MISP/commit/07f3486d5.patch"
                    ],
                    "timestamp": "2026-09-28T11:41:23Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20257"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-103659",
    "datePublished": "2026-10-01T08:32:55.873922Z",
    "dateReserved": "2026-10-01T08:33:03.219Z",
    "dateUpdated": "2026-10-01T08:33:03.298255Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20257"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.