MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = "<?php echo $org;?>";. Because the value was placed inside a double-quoted JavaScript string without any encoding, an organization name containing a double-quote character (or a backslash) could terminate the string literal and inject arbitrary JavaScript into the page. The injected script would execute in the context of any authenticated user who subsequently loads the admin email page, potentially allowing session hijacking, data exfiltration, or privileged actions performed on behalf of the victim. Exploitation requires the ability to set or modify the MISP.org organization name and a second authenticated user visiting the affected admin email view. The vulnerability is a classic instance of insufficient output encoding in a JavaScript context.
| Métrique | Valeur | Interprétation |
|---|---|---|
|
AV (Vecteur d'Attaque)
Attack Vector
|
Network (N)
|
Exploit possible à distance via réseau (HTTP, API, etc.) |
|
AC (Complexité d'Attaque)
Attack Complexity
|
Low (L)
|
Peu de conditions requises pour exploiter |
|
PR (Privilèges Requis)
Privileges Required
|
High (H)
|
Authentifié avec privilèges administratifs |
|
UI (Interaction Utilisateur)
User Interaction
|
Unknown (P)
|
Interaction inconnue |
|
S (Périmètre)
Scope
|
Unchanged (U)
|
Impact reste dans le périmètre du composant compromis |
|
C (Impact Confidentialité)
Confidentiality Impact
|
Low (L)
|
Divulgation limitée d'informations |
|
I (Impact Intégrité)
Integrity Impact
|
Low (L)
|
Modification limitée des données possible |
|
A (Impact Disponibilité)
Availability Impact
|
None (N)
|
Aucune interruption de service |
MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View