CVE-2025-48740

A Cross-Site Request Forgery CSRF vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows a remote attacker to trigger requests on their victim's behalf, if the attacker lures a privileged user, authenticated with basic...

StrangeBee TheHive 跨站请求伪造漏洞

StrangeBee TheHive is an application from StrangeBee, Inc. A cross-site request forgery vulnerability exists in StrangeBee TheHive versions prior to 5.5.1, which stems from cross-site request forgery and could be exploited by privileged users...

CVE-2025-48741

CVE-2025-48741 affects StrangeBee TheHive. A Broken Access Control flaw allows remote, authenticated, and unprivileged users to retrieve alerts, cases, logs, observables, or tasks via a specific API endpoint. Affected ranges and fixes: 5.2.0–5.2.15 → upgrade to 5.2.16+, 5.3.0–5.3.10 → upgrade to ...

PT-2025-22824 · Strangebee · Thehive

Name of the Vulnerable Software and Affected Versions: StrangeBee TheHive versions 5.2.0 through 5.2.15 StrangeBee TheHive versions 5.3.0 through 5.3.10 StrangeBee TheHive versions 5.4.0 through 5.4.9 Description: A Broken Access Control issue allows remote, authenticated, and unprivileged users ...

StrangeBee TheHive 安全漏洞

StrangeBee TheHive is an application from StrangeBee, Inc. A security vulnerability exists in StrangeBee TheHive versions prior to 5.4.10, which stems from improper access control and could lead to unauthorized users retrieving data...

CVE-2025-48740

CSRF vulnerability (CVE-2025-48740) affects StrangeBee TheHive prior to specific fixes: 5.2.0–5.2.15, 5.3.0–5.3.10, 5.4.0–5.4.9, and 5.5.0. A remote attacker could trigger unauthorized requests on behalf of a privileged user authenticated with basic authentication. Root cause: CSRF in TheHive com...

CVE-2025-48740

A Cross-Site Request Forgery CSRF vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows a remote attacker to trigger requests on their victim's behalf, if the attacker lures a privileged user, authenticated with basic...

CVE-2024-22877

StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting XSS in the case reporting functionality. This feature allows an attacker to insert malicious JavaScript code inside the template or its variables, that will be executed in the context of the TheHive application when the HTML...

CVE-2024-22876

StrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting XSS in the case attachment functionality which enables an attacker to upload a malicious HTML file with Javascript code that will be executed in the context of the The Hive application using a specific URL...

Cross site scripting

StrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting XSS in the case attachment functionality which enables an attacker to upload a malicious HTML file with Javascript code that will be executed in the context of the The Hive application using a specific URL...

Cross site scripting

StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting XSS in the case reporting functionality. This feature allows an attacker to insert malicious JavaScript code inside the template or its variables, that will be executed in the context of the TheHive application when the HTML...

CVE-2024-22876

CVE-2024-22876 – TheHive (StrangeBee) vulnerable versions: 5.1.0–5.1.9 and 5.2.0–5.2.8. The issue is a Cross Site Scripting (XSS) in the case attachment functionality, allowing an attacker to upload a malicious HTML file with JavaScript that executes in the TheHive application context via a speci...

PT-2024-19594 · Strangebee · Thehive

Name of the Vulnerable Software and Affected Versions: StrangeBee TheHive versions 5.1.0 through 5.1.9 StrangeBee TheHive versions 5.2.0 through 5.2.8 Description: The issue concerns a Cross Site Scripting XSS vulnerability in the case attachment functionality. This allows an attacker to upload a...

CVE-2024-22876

StrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting XSS in the case attachment functionality which enables an attacker to upload a malicious HTML file with Javascript code that will be executed in the context of the The Hive application using a specific URL...

CVE-2024-22877

StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting XSS in the case reporting functionality. This feature allows an attacker to insert malicious JavaScript code inside the template or its variables, that will be executed in the context of the TheHive application when the HTML...

CVE-2024-22877

TheHive 5.2.0–5.2.8 is vulnerable to Cross-Site Scripting (XSS) in the case reporting feature. The issue allows an attacker to insert malicious JavaScript into the template or its variables, which executes in the TheHive application's context when the HTML report is opened. Root cause and exact i...

CVE-2023-39069

An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism...

Authentication flaw

An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism...

CVE-2023-39069

An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism...

CVE-2023-39069

An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism...