An unauthenticated resource consumption vulnerability in the MISP cti-transmute activity_timeline endpoint poses a risk of service disruption through excessive resource exhaustion.

The application lacks necessary limits or throttling on the /activity_timeline endpoint, allowing an unauthenticated attacker to exhaust system resources. This is categorized as a resource consumption vulnerability under CWE-770.

Exploitation of this vulnerability could cause the application to become unresponsive, leading to significant system downtime and denial of service for legitimate users. With a CVSS score of 8.7, the impact on business continuity is severe, especially for organizations that rely on the availability of the CTI-Transmute service.

Immediate Action: Apply the latest security updates provided by the vendor to implement proper rate limiting and resource controls.

Proactive Monitoring: Monitor system resource usage, specifically CPU and memory consumption, for spikes related to requests targeting the activity_timeline endpoint.

Compensating Controls: Use a rate-limiting policy at the load balancer or reverse proxy level to restrict the number of requests per IP address to the affected endpoint.

Public Exploit Available: No

Service availability is a critical component of security. It is highly recommended that administrators apply available patches to enforce rate limiting and prevent the potential for denial of service attacks against the application.