Unauthenticated attackers can trigger an uncontrolled resource consumption vulnerability in MISP, potentially leading to significant denial-of-service conditions through persistent storage exhaustion.

This is an uncontrolled resource consumption flaw (CWE-400, CWE-770) where the password-reset and API-access endpoints fail to validate or throttle incoming requests. An unauthenticated attacker can exploit this to force the system to perform excessive persistent storage operations, effectively overwhelming the server.

The vulnerability carries a CVSS score of 8.7, reflecting a high severity due to the potential for service disruption. By abusing the lack of rate limiting and input validation, an attacker can exhaust system resources, leading to downtime for critical threat intelligence operations and potential financial costs related to storage management or infrastructure recovery.

Immediate Action: Update MISP to the latest version that incorporates the flood filter and input validation mechanisms. If an immediate update is not feasible, restrict access to the affected endpoints using network-level controls.

Proactive Monitoring: Monitor server logs and database activity for an abnormal volume of password-reset requests or API-access attempts from single sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) to enforce rate limiting on the /users/forgot and related API-access endpoints to block high-frequency, malicious requests.

Public Exploit Available: No (unknown)

Given the high CVSS score and the potential for service degradation, organizations should treat this vulnerability with high urgency. Administrators must prioritize applying the vendor-supplied patches to implement the necessary rate limiting and input validation, thereby neutralizing the risk of resource exhaustion attacks.