Medium

Cross-Site Scripting (XSS) in MISP app/View/Events/index.ctp

IdentifiersCVE-2023-40224CWE-79· Improper Neutralization of Input…

CVE-2023-40224 is a cross-site scripting vulnerability in MISP affecting version 2.4.174 and earlier. The issue is reported as residing in app/View/Events/index.ctp. Based on the provided content, insufficient technical detail is available to identify the exact sink, the affected parameter or field, or whether the XSS is reflected or stored. The vulnerability was fixed in MISP 2.4.175 and was reported by the BeDisruptive OSS Team.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows execution of attacker-controlled script in a victim user's browser within the security context of the affected MISP application. Depending on victim privileges, this can enable session hijacking, theft of CSRF tokens or other sensitive page data, unauthorized actions performed as the victim, UI redressing, and further compromise of data accessible through the victim's authenticated session.

Mitigation

If you can’t patch tonight, do this now.

Until remediation is applied, reduce exposure by restricting access to the affected MISP instance to trusted users and networks, minimizing opportunities for attacker-supplied content to be rendered in the Events index view, and monitoring for suspicious injected content. Standard browser-side controls such as a restrictive Content Security Policy may reduce exploit reliability, but the provided content does not specify whether such controls are present or sufficient.

Remediation

Patch, then assume compromise.

Upgrade MISP to version 2.4.175 or later, as the provided content states that MISP 2.4.175 fixes CVE-2023-40224. If direct upgrade is not immediately possible, review and patch the vulnerable code in app/View/Events/index.ctp to ensure untrusted data is properly output-encoded for the target HTML/JavaScript context.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

MispMispapplication

Misp-ProjectMispapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

gcveNews

Jan 31, 2026

About - GCVE initiative - Global CVE Allocation System

An existing CVE identifier referenced only as an example of how legacy CVEs are mapped into the GCVE format.

cyberscoopNews

Jan 21, 2026

GCVE launches as a decentralized system for tracking software vulnerabilities | CyberScoop

A specific CVE identifier referenced as an example to illustrate how the proposed GCVE numbering scheme would represent existing CVE IDs for backward compatibility; no technical details about the underlying flaw are provided.

misp projectNews

Aug 24, 2023

MISP 2.4.175 released with various bugs fixed, improvements and security fixes.

A cross-site scripting vulnerability in MISP affecting versions up to 2.4.174, specifically in app/View/Events/index.ctp.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2023-40224

NVD

nvd.nist.gov/vuln/detail/CVE-2023-40224

MITRE CWE · CWE-79

Improper Neutralization of Input During Web…

Patch

github.com/MISP/MISP/commit/0274f8b6332e82317c9529b583d03897adf5883e

Cross-Site Scripting (XSS) in MISP app/View/Events/index.ctp

IdentifiersCVE-2023-40224CWE-79· Improper Neutralization of Input…