A stored cross-site scripting vulnerability in the MISP default theme allows authenticated users with elevated privileges to compromise the browser sessions of site administrators.

This is a stored cross-site scripting (XSS) vulnerability occurring because the application fails to perform HTML-entity encoding on user-supplied galaxy tag names before rendering them in the Galaxies index page. The attack requires an authenticated user with tag-editor privileges to inject malicious scripts into a tag, which then executes when a site administrator views the affected page.

Successful exploitation leads to a compromise of the administrator's browser session, potentially allowing an attacker to perform unauthorized actions within the MISP instance or exfiltrate sensitive session data. While the CVSS score of 6.3 identifies this as a medium-severity issue, the ability to target administrative users increases the risk to the integrity of the threat intelligence data stored within the platform.

Immediate Action: Update MISP to version 2.5.47 or later, which implements HTML-encoding via CakePHP's h() function to neutralize malicious input.

Proactive Monitoring: Review administrative audit logs for suspicious activity or unexpected modifications to galaxy tags and monitor for anomalous browser behavior among privileged users.

Compensating Controls: Ensure that the Overmind theme is utilized instead of the default theme, as it is not affected by this specific vulnerability, and enforce the principle of least privilege regarding tag-editor permissions.

Public Exploit Available: Unknown

Organizations should prioritize the update to MISP version 2.5.47 to resolve this XSS vulnerability. Given the impact on administrative session security, limiting tag-editor privileges to trusted users is recommended until the patch can be deployed across the environment.