Misp@2.4.128 Security Vulnerabilities and Issues — Misp@2.4.128 CVE List

Lucene search

MispMisp2.4.128

3 matches found

CVE•added 2021/01/26 6:15 p.m.•65 views

CVE-2020-24085

A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage() function. Due to a lack of controller validation in "path" parameter, an attacker can execute malicious JavaScript code.

6.1CVSS5.9AI score0.0024EPSS

CVE•added 2020/06/30 2:15 p.m.•33 views

CVE-2020-15412

An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form.

4.3CVSS4.5AI score0.00154EPSS

CVE•added 2020/06/30 2:15 p.m.•32 views

CVE-2020-15411

An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader.

9.8CVSS9.4AI score0.00433EPSS