MISP-Project MISP Project MISP (Malware Information Sharing Platform) any version

An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users to delete attributes of other events. A crafted edit for an event (without attribute UUIDs but attribute IDs set) could overwrite an existing attribute.

An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139. In the implementation of Sharing Groups, the "all org" flag sometimes provided view access to unintended actors.

In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks against every page.

In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks via a global menu link.

An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field.

An issue was discovered in MISP before 2.4.158. There is stored XSS in the event graph via a tag name.

An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters.

In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.

MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection

MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs

MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information

MISP: Improper UUID validation in MISP Collections

MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects

MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users

MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations

Unauthorized exposure of private galaxies in MISP event template creation

MISP Dashboard widget field selection may expose restricted user and organisation data

MISP Event template importer authorization bypass

app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP. This does not cause a leak of the full contents of a file, but does cause a leaks of strings that match certain patterns. Among the data that can leak are passwords from database.php or GPG key passphrases from config.php.

An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another administrator clicks on it.

An issue was discovered in MISP before 2.4.156. A malicious site administrator could store an XSS payload in the custom auth name. This would be executed each time the administrator modifies a user.

app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have).

MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data

MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users

app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search.