MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag).
The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site administrator to visit a crafted URL containing a malicious tag name parameter can execute arbitrary JavaScript in the administrator's browser session.
Preconditions:
-
The target must be running a MISP instance with the legacy taxonomy tag confirmation views enabled.
-
The victim must be an authenticated site administrator.
-
The victim must navigate to the attacker-crafted URL (e.g., via a phishing link).
Security impact:
-
Execution of arbitrary client-side script in the context of the administrator's browser.
-
Potential theft of session tokens, CSRF tokens, or other sensitive data accessible from the page.
-
Potential for performing privileged actions on behalf of the administrator within the MISP interface.
Affected versions: <2.5.48.
The vulnerability is remediated by HTML-encoding the user-supplied tag name value before it is interpolated into the confirmation form description text. This ensures that any HTML metacharacters in the input are rendered as inert text rather than executable markup, neutralizing the reflected XSS vector.