PT-2023-27784 · Misp · Misp

Righel · Publicado 2023-08-22 · Atualizado 2023-08-28 · CVE-2023-41098

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MISP version 2.4.174

Description An issue exists in the DashboardsController.php file, specifically a reflected XSS issue via the id parameter when editing a dashboard.

Recommendations For MISP version 2.4.174, consider disabling the id parameter in the DashboardsController.php file until a patch is available. Restrict access to the DashboardsController.php file to minimize the risk of exploitation. Avoid using the id parameter in the affected dashboard edit functionality until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-41098

Produtos afetados

Misp

Referências · 7

• https://github.com/MISP/MISP/commit/09fb0cba65eab9341e81f1cbebc2ae10be34a2b7 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-41098 · Nota de Segurança
• https://t.me/cibsecurity/69044 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1694216446832980037 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-41098 · Aviso do Fabricante
• https://t.me/cvenotify/57142 · Publicação no Telegram
• https://t.me/cvenotify/57467 · Publicação no Telegram