Misp-Project Misp vulnerabilities

CVE-2019-11813 [MEDIUM] CWE-79 CVE-2019-11813: An issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107. The An issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107. There is persistent XSS via link type attributes with javascript:// links.

CVE-2023-24070 [MEDIUM] CWE-79 CVE-2023-24070: app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Refere app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field.

CVE-2023-24026 [MEDIUM] CWE-79 CVE-2023-24026: In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview p In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.

CVE-2023-28607 [MEDIUM] CWE-79 CVE-2023-28607: js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip. js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip.

CVE-2023-28606 [MEDIUM] CWE-79 CVE-2023-28606: js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips. js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips.

CVE-2021-27904 [MEDIUM] CVE-2021-27904: An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139. In the implementation o An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139. In the implementation of Sharing Groups, the "all org" flag sometimes provided view access to unintended actors.

CVE-2026-10855 [MEDIUM] CWE-862 CVE-2026-10855: An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing an event template in overwrite mode, the application checked whether a matching template already existed but did not verify that the importing user belonged to the organization that owned the existing template. As a result, an authenticated user with

CVE-2017-15216 [MEDIUM] CWE-79 CVE-2017-15216: MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a si MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js.

CVE-2020-10246 [MEDIUM] CWE-79 CVE-2020-10246: MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/sta MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp.

CVE-2018-8948 [MEDIUM] CWE-79 CVE-2018-8948: In MISP before 2.4.89, app/View/Events/resolved_attributes.ctp has multiple XSS issues via a malicio In MISP before 2.4.89, app/View/Events/resolved_attributes.ctp has multiple XSS issues via a malicious MISP module.

CVE-2021-25325 [MEDIUM] CWE-79 CVE-2021-25325: MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Re MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs.

CVE-2017-16802 [MEDIUM] CWE-79 CVE-2017-16802: In the sharingGroupPopulateOrganisations function in app/webroot/js/misp.js in MISP 2.4.82, there is In the sharingGroupPopulateOrganisations function in app/webroot/js/misp.js in MISP 2.4.82, there is XSS via a crafted organisation name that is manually added.

CVE-2018-11245 [MEDIUM] CWE-79 CVE-2018-11245: app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes. app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes.

CVE-2022-29532 [MEDIUM] CWE-79 CVE-2022-29532: An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administra An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another administrator clicks on it.

CVE-2018-8949 [MEDIUM] CWE-749 CVE-2018-8949: An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API in An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users to delete attributes of other events. A crafted edit for an event (without attribute UUIDs but attribute IDs set) could overwrite an existing attribute.

CVE-2022-27244 [MEDIUM] CWE-79 CVE-2022-27244: An issue was discovered in MISP before 2.4.156. A malicious site administrator could store an XSS pa An issue was discovered in MISP before 2.4.156. A malicious site administrator could store an XSS payload in the custom auth name. This would be executed each time the administrator modifies a user.

CVE-2024-58128 [MEDIUM] CWE-79 CVE-2024-58128: In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks via a global menu link.

CVE-2024-58129 [MEDIUM] CWE-79 CVE-2024-58129: In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks against every page.

CVE-2022-42724 [MEDIUM] CWE-863 CVE-2022-42724: app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (t app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have).

CVE-2024-57969 [MEDIUM] CWE-863 CVE-2024-57969: app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search. app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search.