Cross-Site Scripting in MISP by Affected Admin Privileges

CVE-2024-58128

What is CVE-2024-58128?

In MISP versions before 2.4.193, a vulnerability exists where parameters in the menu_custom_right_link can be manipulated via the user interface. This design flaw allows attackers with administrative privileges to perform cross-site scripting (XSS) attacks by crafting malicious global menu links. The risk lies in the ability to execute arbitrary scripts in the context of users who access the affected links, potentially leading to data theft and unauthorized actions.

References