PT-2023-25898 · Misp · Misp

Ulaş Deniz İlhan · Publicado 2023-06-30 · Atualizado 2024-02-05 · CVE-2023-37307

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.172

Description The issue arises from the improper sanitization of the title for layout in Correlations, CorrelationExclusions, and Layouts. This could potentially lead to security issues, although specific details about the nature of the exploitation or affected devices are not provided.

Recommendations For versions prior to 2.4.172, update to version 2.4.172 or later to resolve the issue. As a temporary workaround, consider restricting access to the Correlations, CorrelationExclusions, and Layouts features until the update is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-37307

Produtos afetados

Misp

Referências · 8

• https://github.com/MISP/MISP/compare/v2.4.171...v2.4.172 · Correção
• https://github.com/MISP/MISP/commit/286c84fab0047726a6a396ceefaae1bb666fc485 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-37307 · Nota de Segurança
• https://t.me/cibsecurity/65806 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-37307 · Aviso do Fabricante
• https://zigrin.com/advisories/misp-stored-xss · Nota
• http://packetstormsecurity.com/files/176975/MISP-2.4.171-Cross-Site-Scripting.html · Nota
• https://t.me/cvenotify/70070 · Publicação no Telegram