CVE-2022-29532
MediumCVSS 4.8Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
An issue was discovered in MISP before version 2.4.158 related to XSS in the cerebrate view. If one administrator inputs a javascript: URL in the URL field and another administrator clicks on it, it may lead to unauthorized script execution.
Risk Assessment
This vulnerability poses a risk of executing malicious code in the context of another administrator's browser, potentially leading to data theft or session hijacking.
Recommendation
It is recommended to update MISP to version 2.4.158 or later and to avoid entering unsafe URLs in the URL field.
Original NVD description (English source)
An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another administrator clicks on it.