MISP-Project MISP Project MISP (Malware Information Sharing Platform)

MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection

MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs

In app/Controller/TagsController.php in MISP 2.4.118, users can bypass intended restrictions on tagging data.

In MISP 2.4.102, an authenticated user can view sightings that they should not be eligible for. Exploiting this requires access to the event that has received the sighting. The issue affects instances with restrictive sighting settings (event only / sighting reported only).

MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information

MISP: Improper UUID validation in MISP Collections

MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects

MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users

MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations

MISP Dashboard widget field selection may expose restricted user and organisation data

Unauthorized exposure of private galaxies in MISP event template creation

MISP Event template importer authorization bypass

app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP. This does not cause a leak of the full contents of a file, but does cause a leaks of strings that match certain patterns. Among the data that can leak are passwords from database.php or GPG key passphrases from config.php.

The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, which allows admins to discover a hashed password by reading the audit log.

An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another administrator clicks on it.

An issue was discovered in MISP before 2.4.156. A malicious site administrator could store an XSS payload in the custom auth name. This would be executed each time the administrator modifies a user.

An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form.

app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have).

MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data

MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users

app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search.