CVE-2017-13671
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
In MISP before version 2.4.79, there is a persistent XSS vulnerability via the comment field. It only affects users of the same instance because the comment field is not part of MISP synchronization.
Risk Assessment
An attacker can exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or other unwanted actions within the instance.
Recommendation
It is recommended to upgrade MISP to version 2.4.79 or later to mitigate this vulnerability. Additionally, monitoring and restricting access to comment fields is advisable.
Original NVD description (English source)
app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments. It only impacts the users of the same instance because the comment field is not part of the MISP synchronisation.