PT-2020-17069 · Misp · Misp

Published 2020-11-19 · Updated 2020-11-30 · CVE-2020-28947

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MISP version 2.4.134

Description The issue exists in the template element index view due to the mishandling of the id parameter, leading to a cross-site scripting (XSS) problem.

Recommendations For MISP version 2.4.134, consider restricting access to the template element index view until a patch is available, and avoid using the id parameter in this view to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-28947

Affected Products

Misp

References · 5

• https://github.com/MISP/MISP/commit/626ca544ffb5604ea01bb291f69811668b6b5631 · Patch
• https://osv.dev/vulnerability/CVE-2020-28947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28947 · Security Note
• https://t.me/cibsecurity/16605 · Telegram Post
• https://t.me/cvenotify/5834 · Telegram Post