CVE-2024-58129: XSS
Published Mar 28, 2025
·Updated
In MISP before 2.4.193, menucustomrightlinkhtml parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks against every page.
Affected Software
2 affected components
Misp Misp<2.4.193
Misp-project Misp<2.4.193
Remediation
Event History
Mar 28, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-58129?
CVE-2024-58129 has a high severity due to the potential for XSS attacks by authenticated admin users.
2
How can I fix CVE-2024-58129?
To fix CVE-2024-58129, update MISP to version 2.4.194 or later, which addresses the vulnerability.
3
Who is affected by CVE-2024-58129?
CVE-2024-58129 affects MISP installations prior to version 2.4.193 with admin user privileges.
4
What type of attack is possible with CVE-2024-58129?
CVE-2024-58129 allows attackers to perform cross-site scripting (XSS) attacks via the affected parameter.
5
Can this vulnerability be exploited remotely in CVE-2024-58129?
CVE-2024-58129 requires administrative access, so exploitation is limited to authenticated users with admin privileges.