PT-2023-25898 · Misp · Misp

Ulaş Deniz İlhan · Published 2023-06-30 · Updated 2024-02-05 · CVE-2023-37307

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.172

Description The issue arises from the improper sanitization of the title for layout in Correlations, CorrelationExclusions, and Layouts. This could potentially lead to security issues, although specific details about the nature of the exploitation or affected devices are not provided.

Recommendations For versions prior to 2.4.172, update to version 2.4.172 or later to resolve the issue. As a temporary workaround, consider restricting access to the Correlations, CorrelationExclusions, and Layouts features until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-37307

Affected Products

Misp

References · 8

• https://github.com/MISP/MISP/compare/v2.4.171...v2.4.172 · Patch
• https://github.com/MISP/MISP/commit/286c84fab0047726a6a396ceefaae1bb666fc485 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-37307 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37307 · Vendor Advisory
• https://t.me/cibsecurity/65806 · Telegram Post
• https://zigrin.com/advisories/misp-stored-xss · Note
• http://packetstormsecurity.com/files/176975/MISP-2.4.171-Cross-Site-Scripting.html · Note
• https://t.me/cvenotify/70070 · Telegram Post