Security readout for executives and security teams
Plain-English summary
CVE-2018-8949 is a MISP API integrity flaw affecting versions before 2.4.89. A user editing an event could manipulate attribute IDs in a way that overwrites or deletes attributes belonging to other events. The business risk is corrupted threat-intelligence data and loss of trust in shared indicators.
Executive priority
Prioritize remediation if MISP is used for operational threat intelligence or automated sharing. Data integrity loss can mislead detections, incident response, and partner trust even without evidence of active exploitation.
Technical view
The issue is in app/Model/Attribute.php. The CVE describes crafted event edits that omit attribute UUIDs while setting attribute IDs, potentially causing existing attributes to be overwritten and attributes from other events to be deleted. Public sources do not provide CVSS, CWE, or exploit details.
Likely exposure
Exposure is likely limited to organizations running MISP before 2.4.89, especially where users or integrations can edit events through the API. The provided CVE metadata does not identify affected CPEs or downstream packages.
Exploitation context
The source bundle does not show CISA KEV listing or any cited report of active exploitation. The CVE describes a crafted edit scenario, but no public exploit status or weaponized procedure is provided in the supplied sources.
Researcher notes
Evidence is narrow but clear on the vulnerable component and behavior. The public bundle lacks CVSS, CWE, CPE, exploit evidence, and detailed vendor advisory text, so validation should focus on version, patch presence, API permissions, and historical attribute integrity.
Mitigation direction
- Upgrade MISP to version 2.4.89 or later.
- Review the referenced MISP commit and vendor guidance before deploying changes.
- Limit event-editing API privileges to trusted users and integrations.
- Review recent event attribute changes for unexpected overwrites or deletions.
Validation and detection
- Confirm all MISP instances are running 2.4.89 or later.
- Check whether app/Model/Attribute.php includes the referenced fix.
- Audit API-capable accounts with event edit permissions.
- Review logs and event history for anomalous attribute modifications.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-8949 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/MISP/MISP/commit/37720c38d6c617439df0a13e9396fcb26345daddCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.