CVE-2020-10247 : MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to

MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sighting_field.ctp.

Published 2020-03-09 19:15:15

Updated 2023-03-01 18:39:43

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2020-10247

Misp » Misp » Version: 2.4.122
cpe:2.3:a:misp:misp:2.4.122:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 28 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

https://github.com/MISP/MISP/commit/e24a9eb44c1306adb02c1508e8f266ac6b95b4ed

fix: [security] Fixed presistent xss in the sighting popover tool · MISP/MISP@e24a9eb · GitHub
Patch;Third Party Advisory
https://github.com/MISP/MISP/releases/tag/v2.4.123

Release MISP 2.4.123 released (aka the dashboard and security fix release) · MISP/MISP · GitHub
Release Notes;Third Party Advisory

CVEs referencing this url

Jump to