The MISP installer insecurely handles sensitive credential logs, creating a risk where any local unprivileged user can compromise the entire application's administrative and database security.

This vulnerability involves incorrect permission assignment (CWE-732) and path traversal (CWE-22) flaws within the installer scripts. The installer creates world-readable log files and pipes containing raw administrative credentials, and fails to prevent symlink-based redirection during file creation.

Successful exploitation allows any local unprivileged user to obtain administrative, database, and GPG passwords by simply reading logs in the /var/log directory. Given the CVSS score of 6.9, this vulnerability represents a significant threat to confidentiality, as it grants an attacker full administrative control over the MISP instance and its underlying data, leading to a complete compromise of the threat intelligence platform.

Immediate Action: Update MISP to version 2.5.47 or later, which implements strict 0600 file permissions and ensures safe file creation practices.

Proactive Monitoring: Audit the /var/log directory for the presence of misp_install.log files and verify that permissions are restricted to the root user.

Compensating Controls: If immediate patching is not feasible, ensure that the MISP server is isolated from non-administrative users and remove any existing installation logs that contain sensitive credentials.

Public Exploit Available: No

Organizations running MISP must prioritize upgrading to version 2.5.47 immediately to remediate this credential exposure flaw. Because the vulnerability allows for the trivial extraction of administrative passwords, failure to patch leaves the platform and its sensitive threat intelligence data vulnerable to any user with local system access.