The vulnerability stems from the over‑correlation endpoint accepting an "order" query parameter directly from authenticated client requests. This allows the attacker to override the server‑defined ordering of over‑correlating values. The underlying data access layer could interpret the supplied value as part of the SQL ORDER BY clause, leading to manipulation of query ordering. The CVE description indicates that the impact appears limited to query manipulation unless further evidence of SQL injection or data exposure can be demonstrated. The weakness is a classic input‑validation flaw (CWE‑20).

Affected components are MISP’s CorrelationsController, specifically the overCorrelations action defined in app/Controller/CorrelationsController.php. No specific version numbers are listed, but the fix is present in the commit referenced in the CVE. The vendor is misp, product MISP.

The risk is moderate with a CVSS score of 6.4 and no EPSS data available. The vulnerability is not cataloged in the CISA KEV list. It requires authentication, so it is not exploitable by unauthenticated users. The potential for exploitation rests on the data layer’s handling of the ordering clause. Attackers could reorder results, potentially exposing sensitive patterns or bypassing standard retrieval limits. While no confirmed exploitation is reported, the possibility of injection should be considered if the ordering value is not properly sanitized. Overall, the likelihood is low to moderate, but the impact on data visibility warrants timely remediation.