CVE-2021-37534

39th percentile - higher than 39% of all known CVEs

In MISP version 2.4.146, there is a Stored XSS vulnerability in app/View/GalaxyClusters/add.ctp that can be exploited when forking a galaxy cluster.

An attacker can inject malicious JavaScript code that will be executed in users' browsers, potentially leading to data theft or session hijacking.

It is recommended to update MISP to the latest version to mitigate this vulnerability and to review and filter input data in the application.