What is GHSA-p73m-v6fq-jvc8?

GHSA-p73m-v6fq-jvc8 is a security advisory published by GitHub Security Advisories with High severity. app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator...

Which CVE IDs does GHSA-p73m-v6fq-jvc8 cover?

GHSA-p73m-v6fq-jvc8 covers the following CVE IDs: CVE-2019-12868. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p73m-v6fq-jvc8?

GHSA-p73m-v6fq-jvc8 has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

GHSA-p73m-v6fq-jvc8HighCVSS 7.2

app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator...

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

June 22, 2026

🔗 CVE IDs covered (1)

CVE-2019-12868 →

📋 Description

app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and phar:// URLs trigger deserialization.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-12868
https://github.com/MISP/MISP/commit/c42c5fe92783dd306b7600db1f6a25324445b40c
https://zigrin.com/advisories/misp-command-injection-via-phar-deserialization
https://github.com/advisories/GHSA-p73m-v6fq-jvc8