Cross-Site Scripting in MISP by Affected Admin Privileges

CVE-2024-58128

What is CVE-2024-58128?

In MISP versions before 2.4.193, a vulnerability exists where parameters in the menu_custom_right_link can be manipulated via the user interface. This design flaw allows attackers with administrative privileges to perform cross-site scripting (XSS) attacks by crafting malicious global menu links. The risk lies in the ability to execute arbitrary scripts in the context of users who access the affected links, potentially leading to data theft and unauthorized actions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References