Vulnerabilities

MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags.

MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks.

MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules.

The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function.

MISP contains a vulnerability in the handling of module plugin settings.

MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.

MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface.

MISP contains a CSS injection vulnerability in the remote event preview feature.

MISP contains a data integrity flaw in its event deletion logic.

In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push.

MISP contains an access control flaw in the proposal (shadow attribute) visibility logic.

MISP contains a validation flaw in its object synchronization logic.

MISP contains a race condition in the email-based one-time password (OTP) login flow.

On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests.

MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified.

MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users.

The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization.

MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.

MISP contains an authorization flaw in its correlation handling during attribute searches.

MISP contains an authorization bypass in the related events listing functionality.

MISP contains an improper input validation vulnerability in the decaying model import functionality.

MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page.

MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer.

MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature.

MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview.