CVE-2020-24085
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in the SetHomePage() function in app/Controller/UserSettingsController.php. Due to a lack of controller validation in the 'path' parameter, an attacker can execute malicious JavaScript code.
Risk Assessment
The organization may be exposed to attacks that could lead to user data theft or session hijacking. Exploitation of this vulnerability may also impact the organization's reputation.
Recommendation
It is recommended to implement parameter validation in the controller to prevent the injection of malicious code. Additionally, update MISP to the latest version to eliminate this vulnerability.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage() function. Due to a lack of controller validation in "path" parameter, an attacker can execute malicious JavaScript code.