EUVD-2026-90578
GHSA-66pp-jmhc-r9mv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain MISP account access
-
DeliveryCraft analyst-data URL with JS in seed path
-
ExploitPhish authenticated victim to click
-
ExecutionReflected payload executes in victim browser
-
ImpactSteal session token / act as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the analyst data notes panel via the |
| Impact | This is a genuine-but-low-priority reflected XSS (CWE-79). The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, 4.8 Medium) tells the real story: although network-reachable with low attack complexity, exploitation is gated by two independent human/privilege factors - the attacker needs a MISP account (PR:L) and must actively lure an already-authenticated victim into clicking a crafted URL (UI:A, i.e. passive user interaction). The impact is confined to subsequent-system confidentiality/integrity (SC:L/SI:L) - script execution in the victim's browser - with no direct impact on the MISP server itself (VC/VI/VA:N). No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is 'no public exploit identified at time of analysis.' The source-code evidence strongly corroborates the vulnerability and fix: the unsanitized |
| Exploit ScenarioDerived | An attacker with (or who can obtain) a MISP account crafts a URL to the analyst-data view of an attribute/object with a malicious |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Reflected cross-site scripting in the MISP threat-intelligence platform allows an authenticated attacker to inject arbitrary JavaScript into the analyst data notes panel by supplying a crafted value in the 'seed' URL path parameter, which the application reflects unsanitized into inline JavaScript in the rendered page. The victim must already be logged into MISP and be persuaded to open the malicious link (for example via phishing), so exploitation depends on user interaction and prior authentication; impact is confined to the victim's browser session (session token or page-data theft, interface manipulation) rather than the server. The issue affects MISP builds prior to commit 58925dbf0 (post v2.5.48), where the parameter is forcibly cast to an integer; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor assessment rates overall risk as low.
RemediationAI
Apply the upstream fix by upgrading MISP to a build that includes commit 58925dbf0 (the change landing after v2.5.48); per the vendor patch reference, no separately tagged fixed release version has been independently confirmed, so pulling the latest master or confirming your distribution has backported this commit is the safest route (https://github.com/MISP/MISP/commit/58925dbf0). The patch itself is minimal: it casts the 'seed' parameter to an integer in AttributesController::viewAnalystData and ObjectsController::viewAnalystData and normalizes it in the Analyst_data view elements, so if an immediate upgrade is impractical you can replicate this by ensuring the seed value is integer-cast before it reaches the view or by adding a small local patch to the two controllers and two .ctp elements - but note this is a code change rather than a configuration toggle. There is no clean configuration-level workaround, since the vulnerable route is part of normal analyst-data browsing; as compensating controls, restrict MISP access to trusted networks or VPN, enforce strong authentication and short session lifetimes to reduce session-token theft value, and warn analysts against following external or unsolicited links into analyst data views. Blocking or rewriting the seed path segment at a reverse proxy is possible but risks breaking the analyst data panel's random-seed behavior. Side effects of the upstream fix are benign: non-numeric seeds now silently resolve to a random integer, which is the intended behavior and does not alter legitimate integer-seeded views.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-79 reflected cross-site scripting flaw rooted in missing output encoding and absent type enforcement. In MISP's AttributesController and ObjectsController, the viewAnalystData($id, $seed) action accepted the user-supplied 'seed' value from the URL path and passed it straight to the view via $this->set('seed', $seed). The seed is consumed by view elements under View/Elements/genericElements/Analyst_data/ (generic_simple.ctp and thread.ctp), where it was interpolated into inline JavaScript for the analyst data notes panel without escaping. Because the value flowed from a URL path segment into a JavaScript context inside the HTML response, an attacker-controlled string containing JavaScript syntax would execute in the victim's browser origin under the MISP session. The upstream fix (commit 58925dbf0) addresses the root cause by enforcing integer type - the controller now sets (int)$seed ?: mt_rand() and both view elements normalize with empty($seed) ? mt_rand() : (int)$seed - so any non-numeric payload collapses to a random integer and can no longer reach a script context. The CPE cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* confirms the entire MISP product line is in scope up to the patched revision.
Know when Misp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Reflected XSS on a login-gated app (PR:L) needing victim to click a crafted link (UI:R); script runs cross-context in browser (S:C) with low confidentiality/integrity impact.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
DescriptionCVE.org
MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement.
An attacker who can convince an authenticated MISP user to navigate to a crafted URL (for example, via a phishing link) can inject arbitrary JavaScript that executes in the victim's browser context. This may allow the attacker to read session tokens, manipulate the page, or perform actions on behalf of the victim.
Preconditions:
- The victim must be authenticated to MISP and access the analyst data view for an attribute or object.
- The attacker must supply a malicious seed value in the URL path.
Impact:
- Execution of arbitrary JavaScript in the victim's browser session.
- Potential theft of session credentials or sensitive data visible in the page.
- Manipulation of the analyst data interface.
Affected: MISP versions prior to the fix (commit 58925dbf0, post v2.5.48).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An issue was discovered in MISP 2.4.9x before 2.4.99. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
An issue was discovered in MISP before 2.4.158. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo
app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_de
SQL injection in MISP threat intelligence platform versions prior to 2.5.37 allows remote unauthenticated attackers to m
An issue was discovered in MISP before 2.4.158. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitab
MISP 2.4.172 mishandles different certificate file extensions in server sync. Rated high severity (CVSS 7.5), this vulne
In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call. R
An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. Rated critical severity (CVSS 9.8), this v
An issue was discovered in MISP 2.4.128. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyEleme
app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data rel
MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value. Rated
Exploit-DB