Sami Mokaddem

Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, href, link, website, or homepage, were rendered as hyperlinks without validating their URL scheme. An attacker able to supply or influence node or edge property data could provide a malicious value using the javascript: scheme, including variants obfuscated with whitespace or control characters. If a user clicked the generated property link, attacker-controlled JavaScript could execute in the context of the Pivotick application. Successful exploitation could allow the attacker to access information available to the victim’s browser session or perform actions with the victim’s privileges. The vulnerability was addressed by normalizing property values and preventing URLs with non-allowlisted schemes from being rendered as clickable links.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** An authorization bypass exists in the `importModule()` function within the `EventsController`. This flaw allows authenticated users or read-only API keys with event view access to persist data to events they are not permitted to modify. The issue occurs when an import module returns results in the misp standard format, as the write path fails to verify event modification rights before saving the output. This allows a view-only user to inject or alter event data, compromising the integrity of the event content. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** The `importModule()` path uses the `getEnabledModule()` function to resolve a single import module by name. However, this lookup fails to enforce the per-organisation module restrictions that are normally checked by `getEnabledModules()`. Consequently, an authenticated user belonging to an organisation restricted from using a specific module via `Plugin.Import <module> restrict` can still invoke that module directly if the module name is known. This may lead to unauthorised access to restricted import-module functionality and potentially allow the unauthorised import or modification of event data, depending on the specific module and the user's event permissions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.