MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules.
MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only explicitly handled the case where the HTTP status code was not 200 by passing the response through without filtering, on the assumption that non-200 responses would not carry ingestible event data. However, HTTP 2xx status codes other than 200 (such as 201 Created, 203 Non-Authoritative Information, and 206 Partial Content) were also passed through unfiltered. Because MISP may still ingest content from these responses
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- MISP
- Product
- misp-guard
- CVSS v4.0
- 7.7 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Exploitation
- SSVC none, automatable yes, impact partial
- Weakness
- CWE-20
- Exposure class
- Endpoint security
- NVD status
- Received
Why it ranks 19 (Routine)
- CVSS v4.0 7.7 high
- SSVC: automatable
- Product class: endpoint security
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.