CVE-2021-37742: XSS

Published Jul 30, 2021

Updated

app/View/Elements/GalaxyClusters/viewrelationtree.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster relationships.

Affected Software

2 affected components

Misp Misp=2.4.147

Misp-project Misp=2.4.147

Remediation

Patch Available

https://github.com/MISP/MISP/commit/af50add82433eb2a740c3621b99d9d14d2b1e192

Event History

Jul 30, 2021

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·03:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2021-37742?

CVE-2021-37742 is a vulnerability in MISP 2.4.147 that allows stored cross-site scripting (XSS) when viewing galaxy cluster relationships.

What is the severity of CVE-2021-37742?

CVE-2021-37742 has a severity value of 5.4, which is considered medium.

How does CVE-2021-37742 affect MISP?

CVE-2021-37742 affects MISP version 2.4.147 and allows stored XSS when viewing galaxy cluster relationships.

How can I fix CVE-2021-37742?

To fix CVE-2021-37742, update MISP to a version that includes the fix, such as version 2.4.148 or later.

Is there any additional information about CVE-2021-37742?

Yes, you can find more information about CVE-2021-37742 in the references provided: https://github.com/MISP/MISP/commit/af50add82433eb2a740c3621b99d9d14d2b1e192 and https://zigrin.com/advisories/misp-stored-xss-when-viewing-galaxy-cluster-relationships/