CVE-2019-12794

An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins (organization admins have the inherent ability to reset passwords for all of their organization's users). This, however, could be abused in a situation where the host organization of an instance creates organization admins. An organization admin could set a password manually for the site admin or simply use the API key of the site admin to impersonate them. The potential for abuse only occurs when the host organization creates lower-privilege organization admins instead of the usual site admins. Also, only organization admins of the same organization as the site admin could abuse this.

• CWE-269

• https://github.com/MISP/MISP/commit/36b43f1306873cff87b7aa30cdc1a30b38c9c16aPatch, Third Party Advisory
• https://github.com/MISP/MISP/commit/36b43f1306873cff87b7aa30cdc1a30b38c9c16aPatch, Third Party Advisory

Published

Jun 11, 2019

Last Modified

Jun 22, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12788An issue was discovered in Photodex ProShow Producer v9.0.37…7.8
• CVE-2019-12789An issue was discovered on Actiontec T2200H T2200H-31.128L.0…
• CVE-2019-1279Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-12790In radare2 through 3.5.1, there is a heap-based buffer over-…
• CVE-2019-12791A directory traversal vulnerability in the v-list-user scrip…
• CVE-2019-12792A command injection vulnerability in UploadHandler.php in Ve…
• CVE-2019-12795daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, …
• CVE-2019-12797A clone version of an ELM327 OBD2 Bluetooth device has a har…9.8
• CVE-2019-12798An issue was discovered in Artifex MuJS 1.0.5. regcompx in r…
• CVE-2019-12799In createInstanceFromNamedArguments in Shopware through 5.6.…8.8
• CVE-2019-1280A remote code execution vulnerability exists in Microsoft Wi…7.8
• CVE-2019-12801out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by mak…