Medium severity · published Feb 12, 2020
CVE-2020-8890
An issue was discovered in MISP before 2.4.121
5.9
CVSS
1.1%
EPSS
No
On KEV
Description
An issue was discovered in MISP before 2.4.121. It mishandled time skew (between the machine hosting the web server and the machine hosting the database) when trying to block a brute-force series of invalid requests.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Misp · Misp-project
before 2.4.121 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8890
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8890
Patch
https://github.com/MISP/MISP/commit/934c82819237b4edf1da64587b72a87bec5dd520
Patch
https://github.com/MISP/MISP/commit/c1a0b3b2809b21b4df8c1efbc803aff700e262c3
Patch
https://github.com/MISP/MISP/compare/v2.4.120...v2.4.121
More from Misp
10.0
CVE-2026-10611
OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled
9.8
CVE-2026-85216
MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials
9.8
CVE-2024-29858
In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload
9.8
CVE-2024-29859
In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload
9.8
CVE-2024-25675
An issue was discovered in MISP before 2.4.184