Lucene search

[email protected]CVE-2023-28884

HistoryMar 27, 2023 - 3:15 a.m.

CVE-2023-28884

2023-03-2703:15:07

CWE-79

[email protected]

web.nvd.nist.gov

misp

2.4.169

xss

vulnerability

pagination

tool

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

29.5%

JSON

In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index.

CPENameOperatorVersion
misp-project:malware_information_sharing_platformmisp-project malware information sharing platformeq2.4.169

CPE	Name	Operator	Version
misp-project:malware_information_sharing_platform	misp-project malware information sharing platform	eq	2.4.169

References

github.com/MISP/MISP/commit/b94c7978e5e6b1db369abeedbbf00bca975b08b7

zigrin.com/advisories/misp-dom-based-xss/

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

29.5%

JSON

Related for CVE-2023-28884

prion1 cvelist1 osv1