An authenticated session CSRF vulnerability in MISP versions 2.5.45 and earlier allows unauthorized deletion of event data, posing a significant risk to data integrity.

The application incorrectly exposes the cullEmptyEvents function to HTTP GET requests, which bypasses CakePHP's CSRF protection mechanisms. An attacker can trick an authenticated user into visiting a malicious URL, causing the server to execute an irreversible deletion of published empty events.

The exploitation of this vulnerability results in the permanent loss of threat intelligence data, which can severely disrupt security operations and incident response workflows. Given the CVSS score of 8.8, this flaw is categorized as High severity: the ability to trigger irreversible data loss without user consent creates significant operational risk and potential loss of historical investigative records.

Immediate Action: Upgrade to a patched version of MISP that enforces HTTP POST requests for the cullEmptyEvents action, as identified in the vendor repository.

Proactive Monitoring: Review web access logs for unusual patterns of GET requests directed at the cullEmptyEvents endpoint, particularly those originating from unexpected referrers or external sources.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or flag GET requests that attempt to access administrative or state-changing endpoints within the MISP interface.

Public Exploit Available: Unknown

Given the potential for irreversible data loss, organizations using MISP should prioritize applying the vendor provided security updates immediately. Administrators must verify that their installation is updated beyond version 2.5.45 to ensure that the cullEmptyEvents functionality is correctly restricted to POST requests, thereby restoring necessary CSRF protections.