CVE-2024-58129

MediumCVSS 5.5

Published: 28/03/2025(UTC)Updated: 22/06/2026(UTC)Translated: 23/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

In MISP before version 2.4.193, the menu_custom_right_link_html parameters can be set via the UI, allowing attackers with admin privileges to conduct XSS attacks on every page.

Risk Assessment

XSS attacks can lead to session data theft, user account takeover, and other serious security breaches within the organization.

Recommendation

It is recommended to update MISP to version 2.4.193 or later and to restrict UI access for users with admin privileges.

Original NVD description (English source)

In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks against every page.