StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case…
Priority LOW 24CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.
Summary
StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case reporting functionality. This feature allows an attacker to insert malicious JavaScript code inside the template or its variables, that will be executed in the context of the TheHive application when the HTML report is opened.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00289 21st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:strangebee:thehive:*:*:*:*:*:*:*:* | 5.2.0 – 5.2.8 | Vulnerable | StrangeBee |
- cpe:2.3:a:strangebee:thehive:*:*:*:*:*:*:*:* Versions 5.2.0 – 5.2.8 Vulnerable ·StrangeBee
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-22877
- 2026-10-03 Alias added: GHSA-75rf-h4vm-w82h
References
More StrangeBee Thehive vulnerabilities
- TI-2026-45048 TheHive 4.1.24 Unauthenticated Information Disclosure via /api/status Endpoint CVSS 4.0MEDIUM 6.9
- TI-2023-20284 An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote… CVSS 3.1CRITICAL 9.8
- TI-2017-13549 An improper authorization check in the User API in TheHive before 2.13.4 and 3.x before… CVSS 3.0HIGH 8.8
- TI-2024-15161 StrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site… CVSS 3.1MEDIUM 5.4
Sources
- CVE-2024-22877 · CVE Program
- CVE-2024-22877 · NVD
- FIRST EPSS
- GHSA-75rf-h4vm-w82h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences