Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2023-24070: fix: [security] XSS in authkey add · MISP/MISP@f7238fe

app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field.

CVE
#xss#php#auth

@@ -12,7 +12,7 @@

<pre class="quickSelect"><?= h($entity[‘AuthKey’][‘authkey_raw’]) ?></pre>

</div>

<div class="modal-footer">

<a href="<?= $referer ?>" class="btn btn-primary"><?= __(‘I have noted down my key, take me back now’) ?></a>

<a href="<?= h($referer) ?>" class="btn btn-primary"><?= __(‘I have noted down my key, take me back now’) ?></a>

</div>

</div>

<?php

@@ -22,7 +22,7 @@

<p><?= __(‘Please make sure that you note down the auth key below, this is the only time the auth key is shown in plain text, so make sure you save it. If you lose the key, simply remove the entry and generate a new one.’); ?></p>

<p><?=__(‘MISP will use the first and the last 4 characters for identification purposes.’)?></p>

<pre class="quickSelect"><?= h($entity[‘AuthKey’][‘authkey_raw’]) ?></pre>

<a href="<?= $referer ?>" class="btn btn-primary"><?= __(‘I have noted down my key, take me back now’) ?></a>

<a href="<?= h($referer) ?>" class="btn btn-primary"><?= __(‘I have noted down my key, take me back now’) ?></a>

<?php

}

?>

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907