CVE-2023-28606

The CVE-2023-28606 issue affects MISP and stems from the js/event-graph.js component, where tooltips in the event-graph node UI can be exploited to perform XSS. Affected versions are MISP before 2.4.169; remediation is to upgrade to version 2.4.169 or later. The connected sources confirm the vuln...

CVE-2022-48328

CVE-2022-48328 affects MISP prior to 2.4.167, where the file app/Controller/Component/IndexFilterComponent.php mishandles ordered_url_params and additional_delimiters. The consolidated sources (NVD, Red Hat, OSV, etc.) identify this as a vulnerability with a critical CVSS v3.1 base score of 9.8 (...

CVE-2023-28884

CVE-2023-28884: In MISP 2.4.169, the vulnerability resides in app/Lib/Tools/CustomPaginationTool.php, allowing cross-site scripting in the community index. The issue is documented across multiple sources (NVD/OSV/Red Hat) with the impact described as XSS and a base CVSS 3.1 score of 6.1 (Medium)....

CVE-2021-37534

The CVE-2021-37534 entry concerns MISP 2.4.146 where a Stored XSS flaw exists in app/View/GalaxyClusters/add.ctp when forking a galaxy cluster. Affected component is the Galaxy Clusters feature; the root cause is an XSS condition that can allow injected script to run in a victim's browser. Impact...

CVE-2023-24070

Summary : CVE-2023-24070 concerns MISP

CVE-2019-12868

CVE-2019-12868 (MISP 2.4.109) is a remote command execution vulnerability in the PHP component at app/Model/Server.php . The root cause is the use of PHP’s file_exists with user-controlled entries combined with phar:// URLs, which can trigger deserialization and allow a super administrator to exe...

CVE-2015-5721

The vulnerability CVE-2015-5721 affects Malware Information Sharing Platform (MISP) before 2.3.90. A PHP object injection flaw exists via crafted serialized data, related to TemplatesController.php and populate_event_from_template_attributes.ctp. Remote attackers could exploit this to execute cod...

CVE-2017-14337

CVE-2017-14337 affects MISP prior to 2.4.80. When CertAuth via X.509 is used together with a non-MISP external user management REST API, and that API returns an empty value for an external user, an unauthenticated user can be granted access as an arbitrary user. Evidence across connected records ...

CVE-2018-8948

CVE-2018-8948 affects MISP prior to 2.4.89, with multiple XSS flaws in app/View/Events/resolved_attributes.ctp due to a malicious MISP module. Impact is cross-site scripting; the documents do not specify exploit details or a remediation patch/version.

CVE-2019-19379

The CVE-2019-19379 entry concerns MISP version 2.4.118 where the vulnerability resides in app/Controller/TagsController.php, allowing an attacker to bypass intended restrictions on tagging data. The connected documents confirm the affected component (TagsController.php) and the impact (restrictio...

CVE-2021-31780

CVE-2021-31780 affects MISP 2.4.141, specifically the file app/Model/MispObject.php. The vulnerability arises from an incorrect sharing group association: when an object is linked to an event edit, the sharing group object is ignored and the passed local ID is reused, which can disclose informati...

CVE-2023-24027

CVE-2023-24027 affects MISP 2.4.167 with an XSS issue in app/webroot/js/action_table.js triggered via a network history name. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base score 6.1 (Medium). It requires user interaction and has network attack vector; impact concerns c...

CVE-2021-39302

CVE-2021-39302 affects MISP 2.4.148 in certain configurations, where the vulnerability is an SQL injection in the file app/Model/Log.php, via the $conditions['org'] value. This is the concrete vulnerability detail described across connected records. The CVSS metrics provided indicate a high-impac...

CVE-2019-14286

The CVE-2019-14286 entry documents a stored cross-site scripting (XSS) vulnerability in MISP 2.4.111, located in app/webroot/js/event-graph.js for the event-graph view. An attacker must craft a malicious MISP event to trigger the vulnerability when the event-graph view is toggled. The available c...

CVE-2022-47928

Summary: CVE-2022-47928 is a cross-site scripting (XSS) vulnerability in MISP prior to 2.4.167, caused by an XSS flaw in the template file uploads feature (app/View/Templates/upload_file.ctp). The issue is documented across multiple sources (NVD, Red Hat, OSV, etc.) and is specifically tied to th...

CVE-2024-58129

CVE-2024-58129 affects MISP prior to version 2.4.193. The issue allows attackers with admin privileges to set menu_custom_right_link_html through the UI (not the CLI), enabling cross-site scripting on every page. The risk description in the connected documents confirms XSS across pages due to thi...

CVE-2015-5719

CVE-2015-5719 affects Malware Information Sharing Platform (MISP) before 2.3.92. The issue is in app/Controller/TemplatesController.php where filenames under tmp/files/ are not properly restricted. CNVD-2016-07269 notes this allows a local attacker to perform a symbolic link attack to overwrite a...

CVE-2018-12649

CVE-2018-12649 affects MISP 2.4.92 in app/Controller/UsersController.php, where brute-force protection for login only covers POST requests. An adversary can bypass protection by using PUT for login, enabling potential brute-force attempts. The recorded metrics show CVSS v3 base score 9.8 (CRITICA...

CVE-2023-48659

CVE-2023-48659 affects MISP prior to 2.4.176. The issue resides in app/Controller/AppController.php where parameter parsing is mishandled, enabling a high-impact vulnerability per CVSS 3.1 (CRITICAL, 9.8; NETWORK, no user interaction). The connected sources confirm the vulnerable component and it...

CVE-2020-11458

CVE-2020-11458 affects MISP versions prior to 2.4.124, where app/Model/feed.php allows administrators to select arbitrary files to ingest. This does not expose full file contents but can leak strings matching patterns, including passwords from database.php or GPG passphrases from config.php. Rele...

CVE-2020-15411

CVE-2020-15411 affects MISP 2.4.128; the vulnerability stems from insufficient ACL checks in the file app/Controller/AttributesController.php within the Attachment Downloader. The NVD entry shows a CVSSv3.1 base score of 9.8 (CRITICAL) with network attack, no privileges required, no user interact...

CVE-2020-28947

The CVE-2020-28947 issue affects MISP 2.4.134, where an XSS flaw arises in the template element index view due to mishandling of the id parameter. Root cause: improper handling in the template element index view. Impact: cross-site scripting, enabling script execution in the user’s browser in con...

CVE-2021-36212

CVE-2021-36212 affects MISP prior to version 2.4.146, with stored XSS in the file path app/View/SharingGroups/view.ctp affecting the sharing groups view. The NVD/CVE data show a CVSSv3.1 base score of 6.1 (NETWORK, LOW attack complexity, UI REQUIRED, CHANGED scope; Impact: LOW confidentiality/int...

CVE-2023-41098

The CVE-2023-41098 entry concerns MISP version 2.4.174, with a reflected XSS vulnerability in app/Controller/DashboardsController.php via the id parameter when editing a dashboard. Affected software: MISP 2.4.174; vulnerable component: DashboardsController.php (id parameter). Underlying issue: re...

CVE-2017-15216

Summary: CVE-2017-15216 is a reflected XSS vulnerability in MISP prior to version 2.4.81. The issue arises in the quickDelete action used to delete a sighting, related to the files app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js. Affected software: MISP before 2...

CVE-2017-16946

CVE-2017-16946 affects MISP version 2.4.82 where the admin_edit function in app/Controller/UsersController.php mishandles the enable_password field, enabling admins to read the audit log and discover a hashed password. The vulnerability description is consistently reported across multiple feeds (...

CVE-2018-11562

CVE-2018-11562 affects MISP 2.4.91 via a vulnerability in the template file app/View/Elements/eventattribute.ctp that allows reflected XSS when a user clicks a malicious link in an event view and then uses the deleted attributes quick filter. Root cause: improper handling in that view leading to ...

CVE-2019-11812

CVE-2019-11812 is a persistent XSS in MISP prior to 2.4.107. The vulnerability is in the PHP component app/View/Helper/CommandHelper.php, where JavaScript can be injected via the discussion interface and triggered by clicking a link. Affected product/version: MISP (before 2.4.107). Root cause is ...

CVE-2020-15412

The CVE-2020-15412 issue affects MISP 2.4.128 where app/Controller/EventsController.php lacks an event ACL check before allowing a user to submit an event contact form. This is reported across multiple sources (NVD entry and RH/CVE detail) and framed as an ACL authorization flaw in the event subm...

CVE-2020-28043

MISP up to version 2.4.133 contains a SSRF vulnerability in its REST client via the use_full_path parameter, allowing requests to arbitrary URLs. The root cause is exposure of server-side request construction in the REST client, enabling an attacker to induce the application to reach internal or ...

CVE-2023-48657

CVE-2023-48657 affects MISP before 2.4.176. The vulnerability stems from mishandling of filters in app/Model/AppModel.php, as described across multiple feeds (NVD/Red Hat/OSV/etc.). Impact is high: the CVSS 3.1 base score is 9.8 (HIGH/CRITICAL) with NETWORK attack vector, NO user interaction, and...

CVE-2018-11245

CVE-2018-11245 affects MISP 2.4.91, with a DOM-based XSS flaw in app/webroot/js/misp.js related to cortex type attributes. The vulnerability allows injection of arbitrary scripts in web pages rendered by MISP; CVSS v3.0 base score 6.1 (Network, Low complexity, User interaction Required, Confident...

CVE-2019-16202

MISP pre-2.4.115 permits privilege escalation in certain scenarios. After upgrading to 2.4.115, attempts are blocked by the __checkLoggedActions function with a message indicating potential privilege escalation in older vulnerable versions. Connected sources confirm the affected product/version a...

CVE-2019-9482

In MISP 2.4.102, an authenticated user can view sightings they should not be eligible for. Exploitation requires access to the event that received the sighting and affects instances with restrictive sighting settings (event only / sighting reported only). The vulnerability is categorized as an in...

CVE-2023-37307

CVE-2023-37307 affects MISP before 2.4.172. The issue is improper sanitization of the title_for_layout field in Correlations, CorrelationExclusions, and Layouts, enabling (authenticated) stored cross-site scripting as demonstrated by public advisories and exploits. The NVD/OSV/Red Hat/CNNVD refer...

CVE-2018-6926

CVE-2018-6926 affects MISP 2.4.87 in the file app/Controller/ServersController.php . A server setting allowed the override of a path variable on certain Red Hat Enterprise Linux and CentOS systems (where rh_shell_fix was enabled), enabling site admins to inject arbitrary operating system commands...

CVE-2020-25766

CVE-2020-25766 affects MISP prior to 2.4.132. Root cause: a POST operation on a form not linked to the login page can trigger an unwanted action. Affects versions before 2.4.132; documented impact includes possible unauthorized action with low attack complexity (network vector) and no authenticat...

CVE-2023-48655

CVE-2023-48655 affects MISP versions prior to 2.4.176. The issue is in app/Controller/Component/IndexFilterComponent.php, which does not properly filter out query parameters, enabling improper handling of input. This vulnerability is documented across multiple sources (Red Hat, NVD, OSV, CVE list...

CVE-2017-16802

The CVE concerns MISP version 2.4.82 where the function shared ingGroupPopulateOrganisations in app/webroot/js/misp.js is vulnerable to cross-site scripting (XSS). A remote attacker can inject arbitrary script via a specially crafted organisation name added to the list, exposing users to client-s...

CVE-2019-10254

CVE-2019-10254 (MISP) : A Reflected XSS vulnerability exists in the default layout template (app/View/Layouts/default.ctp) of MISP prior to version 2.4.105. The issue arises in the default.ctp template and enables injection of arbitrary web script/HTML. Public references in the CVE describe the a...

CVE-2026-56446

MISP is affected by CVE-2026-56446 where an authenticated site administrator could configure an arbitrary filesystem path for the NDJSON error log via JsonLogTool. Logged data can contain attacker-controlled content, enabling direction of log output to a web-accessible PHP file and potentially in...

CVE-2015-5720

Malware Information Sharing Platform (MISP) versions prior to 2.3.90 expose multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature. Attack vectors involve add.ctp, edit.ctp, and ajaxification.js, enabling remote attackers to inject arbitrary web script or HTML. The p...

CVE-2019-11813

CVE-2019-11813 applies to MISP before 2.4.107, affecting the view component app/View/Elements/Events/View/value_field.ctp. The issue is a persistent XSS via link type attributes using javascript:// links, enabling potentially scripted payloads in affected installations. Root cause is improper han...

CVE-2026-39962

MISP (before version 2.5.36) is affected by an LDAP injection in ApacheAuthenticate.php: improper neutralization of special elements in an LDAP query allows an unsanitized username value to influence the search filter when ApacheAuthenticate.apacheEnv uses a user-controlled server variable (not R...

CVE-2026-56447

The CVE describes a vulnerability in MISP where an authenticated site administrator could set the Kafka_rdkafka_config to an arbitrary filesystem path. MISP parses the referenced INI and forwards its options to librdkafka; a crafted INI could utilize options like plugin.library.paths to load an a...

CVE-2018-8949

CVE-2018-8949 involves MISP before 2.4.89, where a flaw in app/Model/Attribute.php creates an API integrity risk that could let a user delete attributes of other events. A crafted event edit (no attribute UUIDs but with attribute IDs set) could overwrite an existing attribute, potentially impacti...

CVE-2019-11814

The CVE-2019-11814 entry concerns MISP prior to version 2.4.107. Affected: the web UI script at app/webroot/js/misp.js. Description: persistent XSS via image names in titles, demonstrated by a screenshot. Impact as stated centers on XSS exposure in title fields. Exploitation details are not provi...

CVE-2020-14969

In MISP 2.4.127, the file app/Model/Attribute.php lacks an ACL lookup on attribute correlations when using the attribute restsearch API, exposing metadata about a correlating but unreachable attribute. This is a validation/authorization oversight that can reveal sensitive linkage information thro...

CVE-2020-15711

Affected software: MISP (Malware Information Sharing Platform) prior to version 2.4.129. Vulnerability: Cross‑Site Request Forgery (CSRF) in the web application that fails to verify requests originate from trusted users when setting a favourite homepage. Root cause: Inadequate CSRF protection in ...

CVE-2023-48656

CVE-2023-48656 affects MISP versions prior to 2.4.176 due to a flaw in app/Model/AppModel.php that mishandles order clauses. The issue’s impact is described as high for confidentiality, integrity, and availability. The connected documents confirm the affected software/version range and the root c...