CVE-2021-37743

MediumCVSS 5.4

Published: 30/07/2021(UTC)Updated: 22/06/2026(UTC)Translated: 23/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.67%

47th percentile - higher than 47% of all known CVEs

Summary

In MISP version 2.4.147, there is a Stored XSS vulnerability in app/View/GalaxyElements/ajax/index.ctp that can be exploited when viewing galaxy cluster elements in JSON format.

Risk Assessment

An attacker could inject malicious JavaScript code, potentially leading to user data theft or session hijacking.

Recommendation

It is recommended to update MISP to the latest version and implement input data filtering to prevent XSS attacks.

Original NVD description (English source)

app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format.