MISP vulnerabilities

In app/Controller/UsersController.php in MISP before version 2.4.164, there is a vulnerability that allows attackers to discover role names, which should only be accessible to the site administrator.

An issue was discovered in MISP before version 2.4.158 that allows password confirmation to be bypassed in UsersController.php via an 'Accept: application/json' header.

An issue was discovered in MISP before version 2.4.158 related to XSS in app/Controller/OrganisationsController.php occurring in a situation with a 'weird single checkbox page.'

An issue was discovered in MISP before version 2.4.158 related to XSS in the cerebrate view. If one administrator inputs a javascript: URL in the URL field and another administrator clicks on it, it may lead to unauthorized script execution.

An issue was discovered in MISP before version 2.4.158 related to stored XSS in the event graph via a tag name.

An issue was discovered in MISP before version 2.4.158 related to stored XSS in galaxy clusters.

An issue was discovered in MISP before version 2.4.158 related to stored XSS in the LinOTP login field.

An issue was discovered in MISP before version 2.4.156 related to the SVG org logo, which does not forbid the use of JavaScript by default.

An issue was discovered in MISP before version 2.4.156, allowing a malicious site administrator to store an XSS payload in the custom auth name. This payload would be executed each time the administrator modifies a user.

An issue was discovered in MISP before version 2.4.156 that allows Local File Inclusion via the custom terms file setting in app/View/Users/terms.ctp.

In MISP version 2.4.147, there is a Stored XSS vulnerability in app/View/GalaxyElements/ajax/index.ctp that can be exploited when viewing galaxy cluster elements in JSON format.

In MISP version 2.4.147, there is a stored XSS vulnerability in the view_relation_tree.ctp file, allowing malicious code execution when viewing galaxy cluster relationships.

In MISP 2.4.141 in app/Model/MispObject.php, an incorrect sharing group association could lead to information disclosure on an event edit. Instead of using the sharing group object, the passed local ID is reused.

An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139, where the implementation of Sharing Groups sometimes provided view access to unintended actors via the 'all org' flag.

A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in the SetHomePage() function in app/Controller/UserSettingsController.php. Due to a lack of controller validation in the 'path' parameter, an attacker can execute malicious JavaScript code.

MISP version 2.4.136 has an XSS vulnerability that can be exploited via a crafted URL to the user homepage favourite button in app/View/Elements/global_menu.ctp.

MISP version 2.4.136 has an XSS vulnerability via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs.

MISP version 2.4.136 has a Stored XSS vulnerability in the galaxy cluster view that can be exploited via a cluster name in app/View/GalaxyClusters/view.ctp.

In MISP version 2.4.134, there is an XSS vulnerability in the template element index view due to mishandling of the id parameter.

MISP versions up to 2.4.133 allows SSRF (Server-Side Request Forgery) in the REST client via the use_full_path parameter with an arbitrary URL.

An issue was discovered in MISP before 2.4.132 that allows for an unwanted action due to a POST operation on a form not linked to the login page.

In MISP before version 2.4.129, setting a favourite homepage was not protected against CSRF attacks.

An issue was discovered in MISP version 2.4.128, where app/Controller/EventsController.php lacks an event ACL check before allowing a user to send an event contact form.

MISP version 2.4.127 lacks an ACL check on attribute correlations. This occurs when querying the attribute restsearch API, revealing metadata about a correlating but unreachable attribute.

An issue was discovered in MISP before version 2.4.121 where ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php.

An issue was discovered in MISP before version 2.4.121 related to an incorrectly sanitized search string in the Galaxy view in app/View/Galaxies/view.ctp.

An issue was discovered in MISP before version 2.4.121 that did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests.

An issue was discovered in MISP before version 2.4.121, which did not canonicalize usernames when trying to block a brute-force series of invalid requests.

An issue was discovered in MISP before version 2.4.121 that mishandled time skew between the web server and the database, potentially leading to ineffective protection against brute-force attacks.

In MISP 2.4.118 in app/Controller/TagsController.php, users can bypass intended restrictions on tagging data.

MISP versions before 2.4.115 allow privilege escalation in certain situations. After updating to 2.4.115, escalation attempts are blocked by the __checkLoggedActions function.

In MISP version 2.4.109, there is a vulnerability that allows remote command execution by a super administrator. The issue arises from the use of the PHP file_exists function with user-controlled entries, leading to deserialization via phar:// URLs.

An issue was discovered in MISP 2.4.108 that allows organization admins to reset passwords for site admins. This could lead to abuse when the host organization creates lower-privilege organization admins.

An issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107, allowing persistent XSS via link type attributes with javascript:// links.

In MISP version 2.4.102, an authenticated user can view sightings they should not be eligible for. Exploiting this requires access to the event that has received the sighting.

A vulnerability was discovered in MISP version 2.4.91 that allows reflected XSS. The issue is in app/View/Elements/eventattribute.ctp when a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter.

In MISP 2.4.87 in app/Controller/ServersController.php, a vulnerability allows the override of a path variable on certain Red Hat Enterprise Linux and CentOS systems where rh_shell_fix is enabled. This enables site admins to inject arbitrary OS commands.

The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, allowing admins to discover a hashed password by reading the audit log.