PT-2023-27784 · Misp · Misp

Righel · Published 2023-08-22 · Updated 2023-08-28 · CVE-2023-41098

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MISP version 2.4.174

Description An issue exists in the DashboardsController.php file, specifically a reflected XSS issue via the id parameter when editing a dashboard.

Recommendations For MISP version 2.4.174, consider disabling the id parameter in the DashboardsController.php file until a patch is available. Restrict access to the DashboardsController.php file to minimize the risk of exploitation. Avoid using the id parameter in the affected dashboard edit functionality until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-41098

Affected Products

Misp

References · 7

• https://github.com/MISP/MISP/commit/09fb0cba65eab9341e81f1cbebc2ae10be34a2b7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-41098 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41098 · Vendor Advisory
• https://t.me/cibsecurity/69044 · Telegram Post
• https://twitter.com/CVEnew/status/1694216446832980037 · Twitter Post
• https://t.me/cvenotify/57142 · Telegram Post
• https://t.me/cvenotify/57467 · Telegram Post