CVE-2024-58128: XSS
Published Mar 28, 2025
·Updated
In MISP before 2.4.193, menucustomrightlink parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks via a global menu link.
Affected Software
2 affected components
Misp Misp<2.4.193
Misp-project Misp<2.4.193
Remediation
Event History
Mar 28, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-58128?
CVE-2024-58128 is a high severity vulnerability due to the potential for XSS attacks by administrators.
2
How do I fix CVE-2024-58128?
To fix CVE-2024-58128, upgrade to MISP version 2.4.193 or later.
3
Who is affected by CVE-2024-58128?
CVE-2024-58128 affects MISP installations prior to version 2.4.193 that allows admin access.
4
What type of attack can be executed through CVE-2024-58128?
CVE-2024-58128 allows attackers to conduct cross-site scripting (XSS) attacks using menu_custom_right_link parameters.
5
Is user input validation a factor in CVE-2024-58128?
Yes, CVE-2024-58128 indicates a lack of proper input validation for menu_custom_right_link parameters.