MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.
As a result:
- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.
- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.
An authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.
Affected: <2.5.48
MISP versions prior to 2.5.48 contain a vulnerability in the server settings lookup mechanism that allows authenticated users to retrieve sensitive configuration data that should have been redacted. The flaw occurs because branch nodes in the configuration tree do not carry redaction flags, enabling retrieval of entire sub-trees including sensitive secrets such as security salts, Redis passwords, and plugin API keys. This exposure affects any user with access to the server settings endpoints.
MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user's browser.
Preconditions:
- The attacker must be able to control or influence parameter names reported by the misp-modules service.
- A victim must be authenticated and view the affected workflow module page.
Impact:
- Execution of arbitrary JavaScript in the victim's browser session.
- Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.
Affected versions: <2.5.48.
MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the value is interpreted as CSS within the style attribute, allowing a malicious or compromised linked server to inject arbitrary CSS declarations.
An attacker with the ability to create or modify tags on a linked MISP instance can craft a tag colour value containing CSS injection payloads. When a user on the local instance views the event preview, the injected CSS is rendered, potentially allowing UI manipulation, visual spoofing, or limited information disclosure through CSS-based techniques.
Preconditions:
- A linked MISP server relationship exists between the victim instance and the attacker-controlled instance.
- The attacker can create or modify tags on the linked server.
- A victim user views the remote event preview page.
Affected: <2.5.48.
MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks, and attachment scan results.
These orphaned records may contain sensitive threat intelligence data such as correlation mappings, scan results, and report metadata that should have been removed along with the parent event. Their persistence beyond the intended deletion lifecycle creates a risk of unintended data retention and potential information exposure if the records are reachable through other application queries or administrative interfaces.
Preconditions:
- An authenticated user with sufficient privileges to delete events in MISP.
- The event must have associated reports, graphs, correlations, ssdeep chunks, or attachment scan results.
Impact:
- Residual sensitive data persists in the database after the parent event is deleted.
- Accumulation of orphaned records over time may contribute to storage bloat.
- Orphaned records may be inadvertently exposed through other data-access paths that do not validate the existence of the parent event.
Affected versions: <2.5.48
In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.
As a result:
- All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance.
- When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event.
This issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization.
Affected: <2.5.48.
MISP versions prior to 2.5.48 contain an access control vulnerability in the proposal visibility logic. Users in a sharing group could view proposed changes to attributes or objects associated with that group regardless of the intended distribution level restrictions. Additionally, the owning organisation could not view proposals on its own organisation-only attributes. This flaw leads to unauthorized disclosure of proposed attribute changes.
MISP has a validation flaw in its object synchronization logic where objects created without a description are rejected by receiving instances during synchronization. This causes the receiving instance to silently drop the object and its attributes, resulting in loss of threat-intelligence data. The issue occurs when multiple MISP instances synchronize and an authorized user creates an object without a description. It is not exploitable externally but can cause unintended data loss within the sync topology. The affected versions are those prior to 2.5.48.
MISP has a race condition vulnerability in its email-based one-time password (OTP) login flow. When two HTTP requests with the same valid OTP are submitted concurrently, both can authenticate successfully, violating the OTP's one-time-use guarantee. This occurs because OTP validation and deletion are not atomic operations, allowing a second request to reuse the OTP before it is deleted. This affects MISP versions prior to 2.5.48 and requires that email OTP login is enabled and the attacker has a valid OTP. The vulnerability weakens authentication controls and may allow unauthorized access if the OTP is intercepted or shared.
MISP has a cross-site scripting (XSS) vulnerability in its remote event preview page. This occurs when a linked remote MISP server supplies a crafted tag ID that is improperly sanitized in JavaScript context. An authenticated user viewing the event preview and interacting with the tag element may have arbitrary JavaScript executed in their browser session. This could lead to session hijacking or unauthorized actions. The vulnerability affects versions prior to the fix commit around v2.5.48, though the exact boundary is unconfirmed.
MISP has a stored cross-site scripting (XSS) vulnerability in the remote event preview index table rendering. An attacker with write access on a linked remote MISP server can craft event identifiers containing malicious HTML or JavaScript. When a user on the local MISP instance views the remote event preview, the malicious script executes in their browser context. This can lead to arbitrary script execution, session hijacking, data theft, or unauthorized actions. The vulnerability affects versions prior to 2.5.48.
MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature affecting versions prior to 2.5.48. This vulnerability arises because event IDs returned from linked remote MISP servers are rendered without proper output encoding. An attacker controlling or compromising a linked server could inject malicious HTML or JavaScript that executes in the browser of authenticated users viewing the ID Translator page. Exploitation requires an authenticated user, a configured linked server, and navigation to the vulnerable page.
MISP versions prior to 2.5.48 contain an improper input validation vulnerability in the decaying model import functionality. This flaw allows authenticated users with decaying-model permissions to overwrite or modify decaying models belonging to other organizations, including changing ownership and default flags. The vulnerability arises because nested model keys with primary key, organization ID, and default flag can bypass input validation during import.
MISP versions prior to 2.5.48 contain an improper access control vulnerability in the attribute search and paginated attribute view endpoints. Authenticated users with read access to events owned by other organizations could query for soft-deleted attributes and receive data that should have been restricted. This vulnerability exposes confidential soft-deleted threat intelligence attributes from other organizations to unauthorized users, potentially leaking sensitive information that was intended to be hidden.
MISP contains an authorization bypass vulnerability in its related events listing functionality. Authenticated users with access to at least one event can retrieve metadata of related events they are not authorized to view. This occurs because the system uses a correlation table that does not re-validate access rights for each related event, potentially exposing event titles, dates, and correlation counts. The vulnerability affects MISP versions prior to the fix commit 2ffa97f05.
MISP versions prior to 2.5.48 contain an authorization flaw in correlation handling during attribute searches. The system uses a stale distribution snapshot for authorization checks instead of the live event access control list, allowing authenticated users with read access to retrieve attributes and event details from events they no longer have permission to view. This flaw affects confidentiality by exposing unauthorized attribute values and event metadata.
MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer that allows execution of arbitrary JavaScript when viewing crafted TAXII objects. This occurs because JSON string properties are rendered without HTML encoding. An authenticated user with access to the TAXII object viewer who opens a malicious TAXII object can have scripts executed in their browser context, potentially leading to session token theft or unauthorized actions. The vulnerability affects MISP versions prior to 2.5.48.
MISP has a privilege escalation vulnerability in its tag collection creation and editing functionality. An authenticated user with tag editor permissions can exploit this flaw by including additional model data in requests, leading to unauthorized creation or modification of User and Organisation records. This allows escalation from tag editor to site administrator. The vulnerability affects MISP versions prior to 2.5.48.
MISP has a mass assignment vulnerability in its event delegation feature affecting versions prior to 2.5.48. Authenticated users with delegation permission can manipulate delegation records to gain unauthorized read access to arbitrary events and potentially transfer event ownership. This vulnerability allows overwriting existing delegation records and unauthorized event access across organizations.
MISP contains an improper input validation vulnerability in its ORM save path that allows an authenticated user with low-level write permissions to manipulate nested input data. This flaw enables attackers to overwrite, re-parent, or soft-delete database rows belonging to other organizations or events without read access. The vulnerability affects multiple entity types including Attribute, Object, EventReport, Sighting, AttributeTag, and ShadowAttribute. It impacts versions prior to 2.5.48.