Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-58128: MISP Menu Link XSS Attack via Admin Privileges

CVE-2024-58128 · published 1 year ago

Summary

Attackers with admin access can inject malicious code into MISP menus, potentially compromising user accounts. This issue affects MISP versions prior to 2.4.193. Update to the latest version to fix this vulnerability.

What to do

Update misp misp to version 2.4.193 or later.

Affected software

Vendor	Product	Affected versions
misp	misp	< 2.4.193 `cpe:2.3:a:misp:misp::::::::`

Original advisory text

In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks via a global menu link.

References

https://github.com/MISP/MISP/releases/tag/v2.4.193 URL
https://github.com/MISP/MISP/commit/33a1eb66408e16a7535b2bae48303efd9501a26a Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58128... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-58128 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published28 Mar 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-58128 · NVD

CVE-2024-58128 · OSV

Track software like this

Free during beta