The vulnerability allows a site‑administrator who has obtained a hijacked session—such as through a stored cross‑site scripting flaw—to change the Redis host settings exposed via MISP’s web UI or API. By redirecting the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin to an attacker‑controlled Redis instance and restarting the job workers, the attacker can inject malicious job payloads that run with the worker account’s privileges. The exposed download_attachments_on_load setting also enables re‑enabling inline attachment rendering, potentially facilitating further client‑side exploitation. This flaw grants an attacker the ability to execute arbitrary commands within the MISP worker context and to exfiltrate data through the compromised Redis channel.

The affected product is MISP, the Malware Information Sharing Platform. The vulnerability impacts versions that expose Redis host configuration (MISP.redis_host, Plugin.ZeroMQ_redis_host, SimpleBackgroundJobs.redis_host) and the download_attachments_on_load setting via the web UI or API. The exact version range is not disclosed, but any deployment that has not applied the official patch that restricts these parameters to CLI‑only modification is vulnerable.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector is an attacker who already controls a site‑admin session; they would use the UI or API to repoint the Redis hosts and restart workers, after which malicious job payloads could be injected. No external network exploitation is required beyond the hijacked session, but site‑admin privileges are mandatory. The overall risk is that a compromised admin session can lead to remote code execution on the worker process and data exfiltration, though the attacker cannot elevate privileges beyond the worker account unless additional vulnerabilities exist.