CVE-2026-112184
- Source
- https://cve.org/CVERecord?id=CVE-2026-112184
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112184.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-112184
- Published
- 2026-10-19T09:19:45Z
- Modified
- 2026-10-20T02:45:28Z
- Severity
-
- 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
- Summary
- MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels
- Details
-
MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user's browser.
Preconditions:
-
The attacker must be able to control or influence parameter names reported by the misp-modules service.
-
A victim must be authenticated and view the affected workflow module page.
Impact:
-
Execution of arbitrary JavaScript in the victim's browser session.
-
Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.
Affected versions: <2.5.48.
-
- Database specific
{ "cna_assigner": "CIRCL", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112184.json" }- References