Security readout for executives and security teams
Plain-English summary
This issue affects MISP before 2.4.80 in a specific authentication setup. If certificate authentication is combined with an external user-management ReST API, an empty API response can wrongly grant an unauthenticated person access as another user.
Executive priority
Prioritize remediation for exposed MISP deployments because this can bypass authentication and affect threat-intelligence trust boundaries. Non-exposed deployments have lower urgency.
Technical view
CVE-2017-14337 is an authentication bypass in MISP CertAuth integration. When external user management returns an empty value for a certificate-authenticated external user, affected MISP versions may map that request to an arbitrary user instead of rejecting it.
Likely exposure
Exposure is limited to MISP instances before 2.4.80 using X.509 CertAuth together with a non-MISP external user-management ReST API.
Exploitation context
The bundle does not show KEV listing or active exploitation evidence. Exploitation depends on the affected configuration and an external user-management API returning an empty value during certificate authentication.
Researcher notes
Key uncertainty is deployment-specific exposure. The public bundle provides the vulnerable condition and version boundary, but no CVSS, CWE, affected CPEs, or confirmed exploitation evidence.
Mitigation direction
- Upgrade MISP to 2.4.80 or later, following MISP/CIRCL guidance.
- Disable CertAuth or the external user-management integration until upgraded if exposure exists.
- Ensure external user lookups fail closed when identity values are empty.
- Review certificate-authenticated access logs for unexpected user mappings.
Validation and detection
- Inventory MISP versions and identify any instances before 2.4.80.
- Check whether X.509 CertAuth is enabled.
- Check whether a non-MISP external user-management ReST API is configured.
- Verify empty external identity responses are rejected, not mapped to users.
- Confirm the referenced MISP fix is present in deployed code.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-14337 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/MISP/MISP/commit/be111a470204a974c50682054c9c7d4b94396ed9CVE reference · x_refsource_CONFIRM
- https://www.circl.lu/advisory/CVE-2017-14337/CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.