PT-2020-20354 · Misp · Misp

Dawid Czarnecki · Published 2020-02-11 · Updated 2023-09-28 · CVE-2020-8893

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.121

Description An issue was discovered in the Galaxy view, where an incorrectly sanitized search string was found in app/View/Galaxies/view.ctp.

Recommendations For versions prior to 2.4.121, update to version 2.4.121 or later to resolve the issue. As a temporary workaround, consider restricting access to the Galaxy view until the update is applied.

Fix

Related Identifiers

CVE-2020-8893

Affected Products

Misp

References · 7

• https://github.com/MISP/MISP/compare/v2.4.120...v2.4.121 · Patch
• https://github.com/MISP/MISP/commit/3d982d92fd26584115c01f8c560a688d1096b65c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-8893 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8893 · Vendor Advisory
• https://zigrin.com/advisories/misp-reflected-xss-in-galaxy-view · Note
• https://zigrin.com/advisories/misp-bruteforce-protection-not-working-in-very-specific-environments · Note
• https://t.me/cvenotify/900 · Telegram Post