CVE Catalog
CVE-2022-27246
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk0.57%
43th percentile - higher than 43% of all known CVEs
Summary
An issue was discovered in MISP before version 2.4.156 related to the SVG org logo, which does not forbid the use of JavaScript by default.
Risk Assessment
The possibility of injecting malicious JavaScript code through improperly secured SVG logos may lead to XSS attacks, threatening user data security.
Recommendation
It is recommended to update MISP to version 2.4.156 or later and implement appropriate security measures for SVG files.
Original NVD description (English source)
An issue was discovered in MISP before 2.4.156. An SVG org logo (which may contain JavaScript) is not forbidden by default.