Cross-site scripting in MISP
Priority LOW 24CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks against every page.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00227 13th percentileScored 2026-11-07
Fix Fixed MISP (MISP): 2.4.193
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MISP | MISP | before 2.4.193 | 2.4.193 | Patch available | CNA |
- MISP VendorMISP Affected before 2.4.193 Fixed in 2.4.193 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:* | before 2.4.193 | Vulnerable | Misp-project |
- cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:* Versions before 2.4.193 Vulnerable ·Misp-project
Remediation
- Fix · CNA MISP (MISP) Fixed in 2.4.193
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
MISP 2.4.193
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2024-38338 Cross-site scripting in MISPPriority LOW 37
- TI-2024-38336 Cross-site scripting in MISPPriority LOW 24
Timeline
- 2026-10-02 Threatist record created from CVE-2024-58129
- 2026-10-03 Alias added: GHSA-42g5-mrm4-477g
References
More MISP vulnerabilities
- TI-2025-41517 In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. CVSS 3.1CRITICAL 9.0
- TI-2026-65744 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period CVSS 4.0CRITICAL 9.3
- TI-2026-54145 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library CVSS 4.0HIGH 8.8
- TI-2020-10250 MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. CVSS 3.1CRITICAL 9.8
- TI-2026-59159 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding CVSS 4.0HIGH 8.7
- TI-2026-58541 MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials CVSS 4.0CRITICAL 9.5
Sources
- CVE-2024-58129 · CVE Program
- CVE-2024-58129 · NVD
- FIRST EPSS
- GHSA-42g5-mrm4-477g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences