An authenticated stored cross-site scripting vulnerability in MISP allows attackers with galaxy editor permissions to execute malicious scripts in the browser context of other users.

This vulnerability is a stored cross-site scripting (XSS) flaw caused by the failure to encode galaxy names before rendering them in the statistics view. An authenticated user with the perm_galaxy_editor capability can inject malicious scripts that execute when other users view the affected statistics page.

Successful exploitation allows an attacker to hijack user sessions, steal credentials, or perform unauthorized actions within the MISP platform. While the CVSS score of 6.3 identifies this as a medium severity issue, the potential for session hijacking and credential theft in a security-focused platform like MISP poses a significant risk to organizational data integrity and confidentiality.

Immediate Action: Update MISP to version 2.5.47 or later, which implements HTML-encoding for galaxy names to neutralize injected markup.

Proactive Monitoring: Review application access logs for unusual patterns in galaxy creation and monitor for unexpected script execution or unauthorized changes to user-managed content.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block suspicious payloads containing HTML or JavaScript markers in input fields related to galaxy management.

Public Exploit Available: No.

Organizations should prioritize upgrading to version 2.5.47 immediately to remediate this vulnerability. Given that MISP is frequently used to manage sensitive threat intelligence, ensuring that user-provided inputs are properly sanitized is essential to preventing lateral movement and unauthorized access within your security operations workflow.