CVE Catalog
CVE-2022-27244
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk0.46%
36th percentile - higher than 36% of all known CVEs
Summary
An issue was discovered in MISP before version 2.4.156, allowing a malicious site administrator to store an XSS payload in the custom auth name. This payload would be executed each time the administrator modifies a user.
Risk Assessment
A malicious administrator could exploit this vulnerability to execute scripts in the context of other users' browsers, potentially leading to data theft or account takeover.
Recommendation
It is recommended to upgrade MISP to version 2.4.156 or later to mitigate this vulnerability.
Original NVD description (English source)
An issue was discovered in MISP before 2.4.156. A malicious site administrator could store an XSS payload in the custom auth name. This would be executed each time the administrator modifies a user.