Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: MISP 2.4.193 Clear all filters
TI-2024-38338 CVE-2024-58130 · GHSA-rjwx-2xjg-q573

Cross-site scripting in MISP

Priority LOW 37

In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON responses.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00237 Published 2025-03-28 Fixed in 2.4.193 CWE-79
TI-2024-38337 CVE-2024-58129 · GHSA-42g5-mrm4-477g

Cross-site scripting in MISP

Priority LOW 24

In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks against every page.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00227 Published 2025-03-28 Fixed in 2.4.193 CWE-79
TI-2024-38336 CVE-2024-58128 · GHSA-pg7r-jpxf-59rr

Cross-site scripting in MISP

Priority LOW 24

In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks via a global menu link.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00227 Published 2025-03-28 Fixed in 2.4.193 CWE-79