Misp · Misp · CVE-2018-11562
**Name of the Vulnerable Software and Affected Versions**
MISP version 2.4.91
**Description**
A reflected XSS issue was discovered, allowing exploitation if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter. This occurs due to a vulnerability in the `app/View/Elements/eventattribute.ctp` file.
**Recommendations**
For MISP version 2.4.91, consider restricting access to the `eventattribute.ctp` file until a patch is available. As a temporary workaround, avoid using the deleted attributes quick filter in event views to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.