A DOM-based cross-site scripting vulnerability in MISP allows authenticated attackers to execute arbitrary JavaScript in a victim's browser, potentially leading to session hijacking or unauthorized actions.

The vulnerability exists within the ContextualMenu JavaScript class, which uses the unsafe innerHTML property to render user-controllable data into HTML elements. An attacker with low-level privileges can inject malicious scripts that execute within the context of an authenticated user's session.

Successful exploitation allows an attacker to manipulate the browser environment of other authenticated users, including administrators. This can result in the theft of session tokens, the exfiltration of sensitive threat intelligence data, or the execution of unauthorized administrative tasks. While the CVSS score of 6.3 reflects a medium severity, the potential for lateral movement and data compromise in a threat intelligence platform warrants prompt attention.

Immediate Action: Upgrade your MISP installation to version 2.5.47 or later, which replaces unsafe innerHTML assignments with the secure textContent property.

Proactive Monitoring: Review application access logs for suspicious input patterns directed toward contextual menu interactions and monitor for unusual client-side behavior or unauthorized API calls performed by user accounts.

Compensating Controls: Implement strict Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts and utilize a Web Application Firewall to block common XSS payloads, though these measures are secondary to patching the underlying code.

Public Exploit Available: No (exploit_available: false)

The vulnerability represents a significant risk to the integrity of user sessions within the MISP platform. Organizations should prioritize the update to version 2.5.47 during the next maintenance window to eliminate the risk of DOM-based XSS and protect the confidentiality of the threat intelligence handled by the system.