CVE-2026-103664 (GCVE-0-2026-103664)
Vulnerability from cvelistv5 – Published: 2026-10-01 08:55 – Updated: 2026-10-01 15:06
VLAI
EPSS
VEX
Title
MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter
Summary
MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement.
An attacker who can convince an authenticated MISP user to navigate to a crafted URL (for example, via a phishing link) can inject arbitrary JavaScript that executes in the victim's browser context. This may allow the attacker to read session tokens, manipulate the page, or perform actions on behalf of the victim.
Preconditions:
- The victim must be authenticated to MISP and access the analyst data view for an attribute or object.
- The attacker must supply a malicious seed value in the URL path.
Impact:
- Execution of arbitrary JavaScript in the victim's browser session.
- Potential theft of session credentials or sensitive data visible in the page.
- Manipulation of the analyst data interface.
Affected: MISP versions prior to the fix (commit 58925dbf0, post v2.5.48).
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
Supplier · CIRCL (v2.0.3)
Decision recorded 2026-10-01 08:49 UTC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 15:06 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/58925dbf0 | patch |
Impacted products
GCVE extensions
AI-generated
Human-reviewed
Confidence: high
Model
qwen3.8:27b
1 event
advisory
bcp-05-x-01bcp-05-x-02bcp-05-x-03
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-10-01 08:49 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/58925dbf0.patch
7e384946a0fb… - Confidence
- high
| Commit | Subject | Patch SHA-256 |
|---|---|---|
58925dbf01c2
|
fix: [security] Cast the analyst data seed to an integer | 7e384946a0fb… |
Fix summary
The vulnerability is remediated by enforcing integer type on the seed parameter at both the controller layer and the view/template layer. Casting the value to an integer ensures that any non-numeric input (including script payloads) is neutralized before it reaches the inline JavaScript context, eliminating the injection vector.
Patch summary
In AttributesController.php and ObjectsController.php, the seed value set for the view is now cast to an integer with a fallback to a random integer if the cast yields zero. In the two analyst data view templates (generic_simple.ctp and thread.ctp), the seed variable is similarly cast to an integer before use in inline script, replacing the previous logic that only checked for emptiness without type enforcement.
CVSS rationale
AV:N - exploitable over the network via a crafted URL. AC:L - no race conditions or special conditions; a simple URL with a malicious seed suffices. AT:N - no prior manipulation of the target system needed. PR:L - MISP is an authenticated platform; the attacker needs at least a low-privilege account or must target an authenticated user. UI:A - the victim must actively navigate to the crafted URL. VC/VI/VA:N - the server-side confidentiality, integrity, and availability are not directly impacted. SC:L - the victim's browser session data (cookies, tokens) can be read. SI:L - the victim's page content can be modified. SA:N - no impact on security authority.
Weakness rationale
- CWE-79 The user-supplied seed parameter was reflected into inline JavaScript in the HTML response without sanitization or type coercion, allowing script injection. This is a textbook reflected XSS.
Attack pattern rationale
- CAPEC-1 The attacker supplies a malicious value in a URL parameter (seed), which the server reflects unmodified into inline JavaScript in the HTTP response. The victim's browser executes the injected script. This matches the reflected XSS pattern precisely. No uncertainty in this mapping.
Assumptions to verify
- MISP requires user authentication to access the analyst data views; PR:L assumes a low-privilege authenticated account is sufficient for the attacker to craft or deliver the malicious URL.
- The exact fixed version number is not stated in the patch; the fix commit is 32 commits after the v2.5.48 tag, so the fixed version is presumed to be a release after 2.5.48.
- The UI:A rating assumes the victim must click a link or navigate to the crafted URL; if the seed could be injected via a different vector requiring no user interaction, UI could be None.
- CAPEC-1 (Reflected XSS) is selected as the closest match; the injection occurs server-side into the HTML response, distinguishing it from DOM-based XSS (CAPEC-64).
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
9 | 11 | high | 4 |
- 2026-09-24 16:06 UTC Fix developed Corrective change authored (58925dbf01c2fe5dfe9b2f61a421f6463f66ca56): fix: [security] Cast the analyst data seed to an integer https://github.com/MISP/MISP/commit/58925dbf0.patch
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103664",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T15:06:14.886463Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T15:06:25.374Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"AttributesController::viewAnalystData",
"ObjectsController::viewAnalystData",
"Analyst_data view templates"
],
"product": "MISP",
"programFiles": [
"app/Controller/AttributesController.php",
"app/Controller/ObjectsController.php",
"app/View/Elements/genericElements/Analyst_data/generic_simple.ctp",
"app/View/Elements/genericElements/Analyst_data/thread.ctp"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement.\u003c/p\u003e\u003cp\u003eAn attacker who can convince an authenticated MISP user to navigate to a crafted URL (for example, via a phishing link) can inject arbitrary JavaScript that executes in the victim\u0027s browser context. This may allow the attacker to read session tokens, manipulate the page, or perform actions on behalf of the victim.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- The victim must be authenticated to MISP and access the analyst data view for an attribute or object.\u003c/p\u003e\u003cp\u003e- The attacker must supply a malicious seed value in the URL path.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Execution of arbitrary JavaScript in the victim\u0027s browser session.\u003c/p\u003e\u003cp\u003e- Potential theft of session credentials or sensitive data visible in the page.\u003c/p\u003e\u003cp\u003e- Manipulation of the analyst data interface.\u003c/p\u003e\u003cp\u003eAffected: MISP versions prior to the fix (commit 58925dbf0, post v2.5.48).\u003c/p\u003e"
}
],
"value": "MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement.\n\nAn attacker who can convince an authenticated MISP user to navigate to a crafted URL (for example, via a phishing link) can inject arbitrary JavaScript that executes in the victim\u0027s browser context. This may allow the attacker to read session tokens, manipulate the page, or perform actions on behalf of the victim.\n\nPreconditions:\n\n- The victim must be authenticated to MISP and access the analyst data view for an attribute or object.\n\n- The attacker must supply a malicious seed value in the URL path.\n\nImpact:\n\n- Execution of arbitrary JavaScript in the victim\u0027s browser session.\n\n- Potential theft of session credentials or sensitive data visible in the page.\n\n- Manipulation of the analyst data interface.\n\nAffected: MISP versions prior to the fix (commit 58925dbf0, post v2.5.48)."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 XSS - Reflected"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-01T08:49:54Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T08:55:51.589Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/58925dbf0"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability is remediated by enforcing integer type on the seed parameter at both the controller layer and the view/template layer. Casting the value to an integer ensures that any non-numeric input (including script payloads) is neutralized before it reaches the inline JavaScript context, eliminating the injection vector.\u003c/p\u003e"
}
],
"value": "The vulnerability is remediated by enforcing integer type on the seed parameter at both the controller layer and the view/template layer. Casting the value to an integer ensures that any non-numeric input (including script payloads) is neutralized before it reaches the inline JavaScript context, eliminating the injection vector."
}
],
"title": "MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"MISP requires user authentication to access the analyst data views; PR:L assumes a low-privilege authenticated account is sufficient for the attacker to craft or deliver the malicious URL.",
"The exact fixed version number is not stated in the patch; the fix commit is 32 commits after the v2.5.48 tag, so the fixed version is presumed to be a release after 2.5.48.",
"The UI:A rating assumes the victim must click a link or navigate to the crafted URL; if the seed could be injected via a different vector requiring no user interaction, UI could be None.",
"CAPEC-1 (Reflected XSS) is selected as the closest match; the injection occurs server-side into the HTML response, distinguishing it from DOM-based XSS (CAPEC-64)."
],
"capecRationale": [
{
"capecId": "CAPEC-1",
"rationale": "The attacker supplies a malicious value in a URL parameter (seed), which the server reflects unmodified into inline JavaScript in the HTTP response. The victim\u0027s browser executes the injected script. This matches the reflected XSS pattern precisely. No uncertainty in this mapping."
}
],
"commit": "58925dbf01c2fe5dfe9b2f61a421f6463f66ca56",
"confidence": "high",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
}
],
"cvssRationale": "AV:N - exploitable over the network via a crafted URL. AC:L - no race conditions or special conditions; a simple URL with a malicious seed suffices. AT:N - no prior manipulation of the target system needed. PR:L - MISP is an authenticated platform; the attacker needs at least a low-privilege account or must target an authenticated user. UI:A - the victim must actively navigate to the crafted URL. VC/VI/VA:N - the server-side confidentiality, integrity, and availability are not directly impacted. SC:L - the victim\u0027s browser session data (cookies, tokens) can be read. SI:L - the victim\u0027s page content can be modified. SA:N - no impact on security authority.",
"fixSummary": "The vulnerability is remediated by enforcing integer type on the seed parameter at both the controller layer and the view/template layer. Casting the value to an integer ensures that any non-numeric input (including script payloads) is neutralized before it reaches the inline JavaScript context, eliminating the injection vector.",
"generatedAt": "2026-10-01T08:49:54.035056Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 4,
"confidence": "high",
"model": "qwen3.8:27b",
"score": 9
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "7e384946a0fb4f1d43dee43a5374cabf2e70c31add4a6d2e4fa845cdc5ee5b37",
"patchSummary": "In AttributesController.php and ObjectsController.php, the seed value set for the view is now cast to an integer with a fallback to a random integer if the cast yields zero. In the two analyst data view templates (generic_simple.ctp and thread.ctp), the seed variable is similarly cast to an integer before use in inline script, replacing the previous logic that only checked for emptiness without type enforcement.",
"patchTruncated": false,
"patches": [
{
"commit": "58925dbf01c2fe5dfe9b2f61a421f6463f66ca56",
"date": "Thu, 24 Sep 2026 18:06:24 +0200",
"patchSha256": "7e384946a0fb4f1d43dee43a5374cabf2e70c31add4a6d2e4fa845cdc5ee5b37",
"source": "https://github.com/MISP/MISP/commit/58925dbf0.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/58925dbf0.patch",
"subject": "fix: [security] Cast the analyst data seed to an integer"
}
],
"source": "https://github.com/MISP/MISP/commit/58925dbf0.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-01T08:49:54Z",
"version": "2.0.3"
},
"subject": "fix: [security] Cast the analyst data seed to an integer",
"tagVersionBoundary": {
"commits_after_fix": 32,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-79",
"rationale": "The user-supplied seed parameter was reflected into inline JavaScript in the HTML response without sanitization or type coercion, allowing script injection. This is a textbook reflected XSS."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (58925dbf01c2fe5dfe9b2f61a421f6463f66ca56): fix: [security] Cast the analyst data seed to an integer",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/58925dbf0.patch"
],
"timestamp": "2026-09-24T16:06:24Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20241"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-103664",
"datePublished": "2026-10-01T08:55:51.589Z",
"dateReserved": "2026-10-01T08:55:49.992Z",
"dateUpdated": "2026-10-01T15:06:25.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"AttributesController::viewAnalystData",
"ObjectsController::viewAnalystData",
"Analyst_data view templates"
],
"product": "MISP",
"programFiles": [
"app/Controller/AttributesController.php",
"app/Controller/ObjectsController.php",
"app/View/Elements/genericElements/Analyst_data/generic_simple.ctp",
"app/View/Elements/genericElements/Analyst_data/thread.ctp"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement.\n\nAn attacker who can convince an authenticated MISP user to navigate to a crafted URL (for example, via a phishing link) can inject arbitrary JavaScript that executes in the victim\u0027s browser context. This may allow the attacker to read session tokens, manipulate the page, or perform actions on behalf of the victim.\n\nPreconditions:\n\n- The victim must be authenticated to MISP and access the analyst data view for an attribute or object.\n\n- The attacker must supply a malicious seed value in the URL path.\n\nImpact:\n\n- Execution of arbitrary JavaScript in the victim\u0027s browser session.\n\n- Potential theft of session credentials or sensitive data visible in the page.\n\n- Manipulation of the analyst data interface.\n\nAffected: MISP versions prior to the fix (commit 58925dbf0, post v2.5.48)."
}
],
"id": "CVE-2026-103664",
"lastModified": "2026-10-01T16:17:38.173",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"ssvcData": {
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-01T08:49:54Z",
"version": "2.0.3"
}
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-103664",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T15:06:14.886463Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-10-01T09:17:08.713",
"references": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"url": "https://github.com/MISP/MISP/commit/58925dbf0"
}
],
"sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103664",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T15:06:14.886463Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T15:06:20.671Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"AttributesController::viewAnalystData",
"ObjectsController::viewAnalystData",
"Analyst_data view templates"
],
"product": "MISP",
"programFiles": [
"app/Controller/AttributesController.php",
"app/Controller/ObjectsController.php",
"app/View/Elements/genericElements/Analyst_data/generic_simple.ctp",
"app/View/Elements/genericElements/Analyst_data/thread.ctp"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement.\u003c/p\u003e\u003cp\u003eAn attacker who can convince an authenticated MISP user to navigate to a crafted URL (for example, via a phishing link) can inject arbitrary JavaScript that executes in the victim\u0027s browser context. This may allow the attacker to read session tokens, manipulate the page, or perform actions on behalf of the victim.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- The victim must be authenticated to MISP and access the analyst data view for an attribute or object.\u003c/p\u003e\u003cp\u003e- The attacker must supply a malicious seed value in the URL path.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Execution of arbitrary JavaScript in the victim\u0027s browser session.\u003c/p\u003e\u003cp\u003e- Potential theft of session credentials or sensitive data visible in the page.\u003c/p\u003e\u003cp\u003e- Manipulation of the analyst data interface.\u003c/p\u003e\u003cp\u003eAffected: MISP versions prior to the fix (commit 58925dbf0, post v2.5.48).\u003c/p\u003e"
}
],
"value": "MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement.\n\nAn attacker who can convince an authenticated MISP user to navigate to a crafted URL (for example, via a phishing link) can inject arbitrary JavaScript that executes in the victim\u0027s browser context. This may allow the attacker to read session tokens, manipulate the page, or perform actions on behalf of the victim.\n\nPreconditions:\n\n- The victim must be authenticated to MISP and access the analyst data view for an attribute or object.\n\n- The attacker must supply a malicious seed value in the URL path.\n\nImpact:\n\n- Execution of arbitrary JavaScript in the victim\u0027s browser session.\n\n- Potential theft of session credentials or sensitive data visible in the page.\n\n- Manipulation of the analyst data interface.\n\nAffected: MISP versions prior to the fix (commit 58925dbf0, post v2.5.48)."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 XSS - Reflected"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-01T08:49:54Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T08:55:51.589Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/58925dbf0"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability is remediated by enforcing integer type on the seed parameter at both the controller layer and the view/template layer. Casting the value to an integer ensures that any non-numeric input (including script payloads) is neutralized before it reaches the inline JavaScript context, eliminating the injection vector.\u003c/p\u003e"
}
],
"value": "The vulnerability is remediated by enforcing integer type on the seed parameter at both the controller layer and the view/template layer. Casting the value to an integer ensures that any non-numeric input (including script payloads) is neutralized before it reaches the inline JavaScript context, eliminating the injection vector."
}
],
"title": "MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"MISP requires user authentication to access the analyst data views; PR:L assumes a low-privilege authenticated account is sufficient for the attacker to craft or deliver the malicious URL.",
"The exact fixed version number is not stated in the patch; the fix commit is 32 commits after the v2.5.48 tag, so the fixed version is presumed to be a release after 2.5.48.",
"The UI:A rating assumes the victim must click a link or navigate to the crafted URL; if the seed could be injected via a different vector requiring no user interaction, UI could be None.",
"CAPEC-1 (Reflected XSS) is selected as the closest match; the injection occurs server-side into the HTML response, distinguishing it from DOM-based XSS (CAPEC-64)."
],
"capecRationale": [
{
"capecId": "CAPEC-1",
"rationale": "The attacker supplies a malicious value in a URL parameter (seed), which the server reflects unmodified into inline JavaScript in the HTTP response. The victim\u0027s browser executes the injected script. This matches the reflected XSS pattern precisely. No uncertainty in this mapping."
}
],
"commit": "58925dbf01c2fe5dfe9b2f61a421f6463f66ca56",
"confidence": "high",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
}
],
"cvssRationale": "AV:N - exploitable over the network via a crafted URL. AC:L - no race conditions or special conditions; a simple URL with a malicious seed suffices. AT:N - no prior manipulation of the target system needed. PR:L - MISP is an authenticated platform; the attacker needs at least a low-privilege account or must target an authenticated user. UI:A - the victim must actively navigate to the crafted URL. VC/VI/VA:N - the server-side confidentiality, integrity, and availability are not directly impacted. SC:L - the victim\u0027s browser session data (cookies, tokens) can be read. SI:L - the victim\u0027s page content can be modified. SA:N - no impact on security authority.",
"fixSummary": "The vulnerability is remediated by enforcing integer type on the seed parameter at both the controller layer and the view/template layer. Casting the value to an integer ensures that any non-numeric input (including script payloads) is neutralized before it reaches the inline JavaScript context, eliminating the injection vector.",
"generatedAt": "2026-10-01T08:49:54.035056Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 4,
"confidence": "high",
"model": "qwen3.8:27b",
"score": 9
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "7e384946a0fb4f1d43dee43a5374cabf2e70c31add4a6d2e4fa845cdc5ee5b37",
"patchSummary": "In AttributesController.php and ObjectsController.php, the seed value set for the view is now cast to an integer with a fallback to a random integer if the cast yields zero. In the two analyst data view templates (generic_simple.ctp and thread.ctp), the seed variable is similarly cast to an integer before use in inline script, replacing the previous logic that only checked for emptiness without type enforcement.",
"patchTruncated": false,
"patches": [
{
"commit": "58925dbf01c2fe5dfe9b2f61a421f6463f66ca56",
"date": "Thu, 24 Sep 2026 18:06:24 +0200",
"patchSha256": "7e384946a0fb4f1d43dee43a5374cabf2e70c31add4a6d2e4fa845cdc5ee5b37",
"source": "https://github.com/MISP/MISP/commit/58925dbf0.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/58925dbf0.patch",
"subject": "fix: [security] Cast the analyst data seed to an integer"
}
],
"source": "https://github.com/MISP/MISP/commit/58925dbf0.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-01T08:49:54Z",
"version": "2.0.3"
},
"subject": "fix: [security] Cast the analyst data seed to an integer",
"tagVersionBoundary": {
"commits_after_fix": 32,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-79",
"rationale": "The user-supplied seed parameter was reflected into inline JavaScript in the HTML response without sanitization or type coercion, allowing script injection. This is a textbook reflected XSS."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (58925dbf01c2fe5dfe9b2f61a421f6463f66ca56): fix: [security] Cast the analyst data seed to an integer",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/58925dbf0.patch"
],
"timestamp": "2026-09-24T16:06:24Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20241"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-103664",
"datePublished": "2026-10-01T08:55:51.589Z",
"dateReserved": "2026-10-01T08:55:49.992Z",
"dateUpdated": "2026-10-01T15:06:25.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…