The qualifier 'normal usage not affected' in this CVE is doing more analytical work than it first appears. It reveals that MISP's STIX parser treats isolation as an opt-in property rather than a default. The safe path — instantiating a fresh parser for each conversion — isn't the intended design; it's the fallback that emerged because the direct path (reusing a parser object) is architecturally dangerous. This inverts what developers expect from a threat intelligence transformation tool.
The vulnerability mechanism is straightforward but easy to miss: the parser retains state across conversions. Galaxy clusters, passive DNS records, timestamps, and package metadata from one STIX document can bleed into subsequent conversions processed by the same parser instance. In MISP's threat intelligence model, this isn't just wrong metadata — it's wrong attribution. A phishing indicator could inherit galaxy context from an unrelated intrusion set. An event timeline could anchor to a document from a completely different operation. The contamination looks legitimate, which makes it dangerous.
The CVSS 6.3 with 'limited disclosure' framing badly understates the risk. The 'limited' qualifier describes minimum exploitation conditions, not actual impact once contamination enters shared state. One contaminated event can update shared galaxy clusters, populate shared passive DNS records, and propagate to every downstream consumer of your MISP instance. The 'ordering dependent' exploitation caveat isn't a mitigation — it's an attacker's feature. If an attacker-controlled document is processed before legitimate intelligence, contamination becomes attribution injection.
The deeper problem is API design. A transformation tool should not expose a stateful, reusable parser object. The existence of the reusable parser invites reuse, and developers optimizing for throughput — thread pools, streaming pipelines, batch processing — will naturally cache parser instances. The performance-conscious implementation is punished with a vulnerability, while the naive sequential approach is accidentally safe.
If you're maintaining a MISP integration: audit for parser reuse patterns. Any code that instantiates a parser once and processes multiple STIX documents through it is vulnerable. The safe pattern (new parser per file) works, but the safer design is a single-use conversion function that owns its parser internally — no object to misuse, no state to leak. Given that this pattern has appeared in HTTP session contamination, template engine leakage, and connection pool fingerprinting, treat this as a class of vulnerability to hunt for in any integration that exposes reusable transformation objects.