Cross-Site Scripting Vulnerability in MISP AuthKey Display
CVE-2023-24070

6.1MEDIUM

Key Information:

Vendor

Misp-project

Status
Malware Information Sharing Platform
Vendor
CVE Published:
23 January 2023

What is CVE-2023-24070?

An XSS vulnerability was identified in the MISP application specifically within the authkey display functionality. The issue arises in the app/View/AuthKeys/authkey_display.ctp file, where the application improperly handles input from the Referer field. This flaw allows attackers to inject and execute malicious scripts, which could compromise user sessions or manipulate the content viewed by users. It's crucial for administrators to apply patches and monitor their MISP installations to mitigate potential threats from this vulnerability.

References

https://github.com/MISP/MISP/commit/f7238fe5e71ac065daa43...
https://zigrin.com/advisories/misp-xss-in-add-action-of-t...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.