MISP patches XSS flaws in 2.5.10 release
MISP 2.5.10 and 2.4.208 fix stored XSS vulnerabilities and insecure defaults reported by Cparta Cyber Defense researcher Patrik Wallström.
Sourcemisp-project.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
MISP, the widely used open-source threat intelligence platform, released versions 2.5.10 and 2.4.208 addressing several security issues alongside functional improvements. The security fixes include stored XSS vulnerabilities in Galaxy killchain elements and icon elements, potentially insecure defaults in the uploadFile/deleteFile type parameter (exploitable only under misconfiguration), and exposure of S3 access keys in plugin settings. These issues were reported by Patrik Wallström of Cparta Cyber Defense.
Beyond the security patches, the release improves authentication plugin handling for OIDC and LDAP, adds LDAP filter escaping, introduces validation for S3 bucket operations, and improves sync warning logging and workflow editor caching behavior. The MISP project recommends all users, particularly those relying on authentication plugins, remote sync, S3 storage, or Galaxy features, upgrade promptly and review configurations for secure defaults.
No evidence of active exploitation is presented; this is a routine vendor patch release addressing responsibly disclosed vulnerabilities in a defensive security tool.
Source reporting: https://www.misp-project.org/2025/04/04/misp.2.5.10.and.2.4.208.released.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs