CVE Catalog
CVE-2024-58128
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk0.19%
9th percentile - higher than 9% of all known CVEs
Summary
In MISP before version 2.4.193, the menu_custom_right_link parameters can be set via the UI, allowing attackers with admin privileges to conduct XSS attacks through a global menu link.
Risk Assessment
An XSS attack can lead to session data theft, admin account takeover, or injection of malicious code into the application, posing a threat to the organization's security.
Recommendation
It is recommended to update MISP to version 2.4.193 or later and restrict access to administrative functions to trusted users.
Original NVD description (English source)
In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks via a global menu link.