Cross-Site Scripting Vulnerability in MISP by MISP Project
CVE-2023-28607

6.1MEDIUM

Key Information:

Vendor: Misp-project
Status: Malware Information Sharing Platform
Vendor: CVE Published:; 18 March 2023

🔔 Create Misp-project Vulnerability Alert

What is CVE-2023-28607?

MISP versions prior to 2.4.169 are susceptible to a Cross-Site Scripting (XSS) vulnerability in the js/event-graph.js component. This weakness allows attackers to inject malicious scripts via the event-graph relationship tooltip, potentially compromising user interactions and data integrity. It is crucial for users to upgrade to the latest version to mitigate any risks associated with this vulnerability.

References

https://github.com/MISP/MISP/compare/v2.4.168...v2.4.169

https://github.com/MISP/MISP/commit/78f423451a4c795991e73...

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Mar 18, 2023
Vulnerability Reserved
Mar 18, 2023

CVE-2023-28607 Data

JSON