PT-2026-104360 · Misp · Misp
CVSS v4.0
5.1
متوسطة
| المتجه | AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
MISP versions prior to 2.5.48
Description
The ID Translator feature contains a cross-site scripting (XSS) flaw. When a user accesses the ID Translator page, the application retrieves event identifiers from linked remote servers. Because the application fails to properly encode the event ID returned by the remote server before rendering it in the HTML output, a compromised or malicious linked server can provide a crafted event ID containing arbitrary HTML or JavaScript. This allows the execution of scripts in the browser of an authenticated user, potentially leading to session hijacking or credential theft.
Recommendations
Update to version 2.5.48 or later.
استغلال
إصلاح
XSS
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Misp