Misp · Misp · CVE-2021-25325
**Name of the Vulnerable Software and Affected Versions**
MISP version 2.4.136
**Description**
The issue is related to a lack of input data sanitization in the app/View/GalaxyElements/ajax/index.ctp component of the MISP platform, which can be exploited to perform cross-site scripting (XSS) attacks. Specifically, reference types could contain javascript: URLs, allowing a remote attacker to execute malicious scripts.
**Recommendations**
For MISP version 2.4.136, as a temporary workaround, consider disabling the `app/View/GalaxyElements/ajax/index.ctp` component until a patch is available. Restrict access to the `galaxy cluster element values` to minimize the risk of exploitation. Avoid using reference types that contain `javascript:` URLs in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.