CVE-2015-5720

EUVD-2015-5667
Multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware Information Sharing Platform (MISP) before 2.3.90 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) add.ctp, (2) edit.ctp, and (3) ajaxification.js.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 47%
Affected Products (NVD)
VendorProductVersion
misp-projectmalware_information_sharing_platform
𝑥
≤ 2.3.89
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/92738
https://github.com/MISP/MISP/commit/812ac878c3645c02e2a599287117418424cbd4cf
https://www.circl.lu/advisory/CVE-2015-5720/
http://www.securityfocus.com/bid/92738
https://github.com/MISP/MISP/commit/812ac878c3645c02e2a599287117418424cbd4cf
https://www.circl.lu/advisory/CVE-2015-5720/