CVE-2023-28607

MediumCVSS 6.1

Published: 18/03/2023(UTC)Updated: 23/06/2026(UTC)Translated: 24/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

30th percentile - higher than 30% of all known CVEs

The js/event-graph.js file in MISP before version 2.4.169 is vulnerable to XSS via the event-graph relationship tooltip.

An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking.

It is recommended to upgrade MISP to version 2.4.169 or later to mitigate this vulnerability.

Original NVD description (English source)

js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip.