MISP – Stored XSS when viewing Galaxy Cluster Relationships

DATE

29.09.2021

Affected Vendor

CIRCL – Computer Incident Response Center Luxembourg

Affected Product

MISP – Open Source Threat Intelligence Platform & Open Standards For Threat Information Sharing – https://www.misp-project.org/

Vulnerable version

2.4.147

Fixed version

2.4.148

CVSS

5.4 Medium CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Recommendations

Update to MISP version 2.4.148

Vulnerability details

When a user views a galaxy cluster relationships, a store cross-side scripting can be triggered.

CVE

CVE-2021-37742

Credits

Dawid Czarnecki

References

Do you think the security of your data might be lacking? Let's find the best approach together.
Once you contact us, we will ask you about the project you want to secure.

NEED A CONSULTATION?

Contact Us