MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without proper output encoding.
A malicious or compromised linked server could return a crafted event ID containing arbitrary HTML or JavaScript markup. This markup would be rendered in the browser of any user in the host organization who views the ID Translator page, enabling session hijacking, credential theft, or other client-side attacks.
Preconditions:
- The victim must be an authenticated user of the host MISP instance.
- A linked server must be configured on the host instance.
- The victim must navigate to the ID Translator page for a given event.
Affected versions: <2.5.48.
"}],"value":"MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without proper output encoding.\n\nA malicious or compromised linked server could return a crafted event ID containing arbitrary HTML or JavaScript markup. This markup would be rendered in the browser of any user in the host organization who views the ID Translator page, enabling session hijacking, credential theft, or other client-side attacks.\n\nPreconditions:\n\n- The victim must be an authenticated user of the host MISP instance.\n\n- A linked server must be configured on the host instance.\n\n- The victim must navigate to the ID Translator page for a given event.\n\nAffected versions: <2.5.48."}],"impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1 XSS - Reflected"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"SSVC","other":{"content":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"Supplier","timestamp":"2026-10-02T15:17:39Z","version":"2.0.3"},"type":"SSVC"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-02T15:21:53.492Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/MISP/commit/bd5e80c84"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The vulnerability is remediated by enforcing integer typing on the remote event ID at the point where it enters the application data structure in the controller, and by applying HTML output encoding (the h() helper) to all user-visible fields (remote_id, server_id) in both the default and Overmind-themed ID Translator views. This ensures that even if a remote server returns non-numeric or markup-laden data, it cannot be interpreted as HTML by the browser.
"}],"value":"The vulnerability is remediated by enforcing integer typing on the remote event ID at the point where it enters the application data structure in the controller, and by applying HTML output encoding (the h() helper) to all user-visible fields (remote_id, server_id) in both the default and Overmind-themed ID Translator views. This ensures that even if a remote server returns non-numeric or markup-laden data, it cannot be interpreted as HTML by the browser."}],"title":"MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"full","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 30 commits after fix); the exact first affected version is not specified in the patch.","The CAPEC-1 mapping is the closest available pattern; the data source is a server-to-server API response rather than a direct HTTP request parameter, making the 'reflected' classification slightly imprecise.","The attacker is assumed to be a configured linked MISP server; no evidence suggests the vulnerability is exploitable without a pre-existing server link.","The UI:A rating assumes the victim must explicitly navigate to the ID Translator page; it is unclear whether any automated workflow could trigger this view without direct user action.","The Co-Authored-By line references an AI assistant; it is credited as a tool rather than a human remediation developer."],"capecRationale":[{"capecId":"CAPEC-1","rationale":"The closest CAPEC pattern is reflected XSS: data originating from an external source (the linked server's API response) is reflected into the rendered HTML page without encoding. The mapping is slightly imprecise because the data source is a server-to-server API response rather than a direct user-supplied request parameter, but the mechanism (untrusted data reflected into HTML) matches CAPEC-1 most closely among available patterns. CAPEC-120 (Persistent XSS) was considered but the data is not stored in the victim's database; it is fetched live from the remote server and rendered, making the reflected pattern a better fit."}],"commit":"bd5e80c84f0ab853d88d14e14df9bd92786eb8f4","confidence":"medium","credits":[{"lang":"en","type":"reporter","value":"Jeroen Pinoy"},{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Opus 5.5 (1M context)"}],"cvssRationale":"AV:N: The attack originates from a remote linked server over the network. AC:L: No race conditions or special timing are required; the linked server simply returns a crafted ID. AT:N: No active user interaction is needed to set up the attack (the malicious server is already linked). PR:N: The attacker is the linked server itself and does not need credentials on the victim's instance. UI:A: The victim must actively navigate to the ID Translator page for the payload to execute. VC:N/VI:N/VA:N: The vulnerable component (MISP server) is not directly compromised; the impact is client-side. SC:L: A successful XSS can read cookies, session tokens, or page data in the victim's browser. SI:L: The attacker can modify the rendered page content. SA:N: No impact on the security authority of the system.","fixSummary":"The vulnerability is remediated by enforcing integer typing on the remote event ID at the point where it enters the application data structure in the controller, and by applying HTML output encoding (the h() helper) to all user-visible fields (remote_id, server_id) in both the default and Overmind-themed ID Translator views. This ensures that even if a remote server returns non-numeric or markup-laden data, it cannot be interpreted as HTML by the browser.","generatedAt":"2026-10-02T15:17:39.791225Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":11,"assumptionCount":5,"confidence":"medium","model":"qwen3.8:27b","score":7}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"398814c5f528eb504bfc173c7ed3258a171d9f3feeca03d8ba4fff252d3a8c1f","patchSummary":"In ServersController.php, the remote_event['id'] value is cast to (int) in two locations where it is stored in the remote_events array and where it is extracted from the API response. In app/View/Servers/id_translator.ctp, the h() escaping function is applied to remote_id in the anchor text and to both server_id and remote_id in the preview URL. In app/View/Themed/Overmind/Servers/id_translator.ctp, h() is applied to remote_id in the badge display and to server_id and remote_id in the preview link. An 'exception' key is also initialized to null in the first array construction for consistency.","patchTruncated":false,"patches":[{"commit":"bd5e80c84f0ab853d88d14e14df9bd92786eb8f4","date":"Thu, 24 Sep 2026 23:24:11 +0200","patchSha256":"398814c5f528eb504bfc173c7ed3258a171d9f3feeca03d8ba4fff252d3a8c1f","source":"https://github.com/MISP/MISP/commit/bd5e80c84.patch","sourceUrl":"https://github.com/MISP/MISP/commit/bd5e80c84.patch","subject":"fix: [security] Treat the remote event id in the ID"}],"source":"https://github.com/MISP/MISP/commit/bd5e80c84.patch","ssvc":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"Supplier","timestamp":"2026-10-02T15:17:39Z","version":"2.0.3"},"subject":"fix: [security] Treat the remote event id in the ID","tagVersionBoundary":{"commits_after_fix":30,"repository":"https://github.com/MISP/MISP","tag":"v2.5.48","version":"2.5.48","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-79","rationale":"The remote event ID returned by a linked server was rendered in HTML output without output encoding, allowing injection of arbitrary markup or script. The fix applies HTML escaping (h()) and integer casting, which is the canonical remediation for CWE-79."}]}},"bcp-05-x-03":{"x_timeline":{"events":[{"description":"Corrective change authored (bd5e80c84f0ab853d88d14e14df9bd92786eb8f4): fix: [security] Treat the remote event id in the ID","id":"evt-fix-developed-1","references":["https://github.com/MISP/MISP/commit/bd5e80c84.patch"],"timestamp":"2026-09-24T21:24:11Z","type":"fix-developed"}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20296"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-104901","datePublished":"2026-10-02T15:21:53.492Z","dateReserved":"2026-10-02T15:21:46.840Z","dateUpdated":"2026-10-02T16:15:49.327Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-02 16:16:47","lastModifiedDate":"2026-10-02 17:17:04","problem_types":["CWE-79","CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","ssvcData":{"timestamp":"2026-10-02T15:17:39Z","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"Supplier","version":"2.0.3"}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:15:35.943839Z","id":"CVE-2026-104901","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"104901","Ordinal":"1","Title":"MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site","CVE":"CVE-2026-104901","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"104901","Ordinal":"1","NoteData":"MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without proper output encoding.\n\nA malicious or compromised linked server could return a crafted event ID containing arbitrary HTML or JavaScript markup. This markup would be rendered in the browser of any user in the host organization who views the ID Translator page, enabling session hijacking, credential theft, or other client-side attacks.\n\nPreconditions:\n\n- The victim must be an authenticated user of the host MISP instance.\n\n- A linked server must be configured on the host instance.\n\n- The victim must navigate to the ID Translator page for a given event.\n\nAffected versions: <2.5.48.","Type":"Description","Title":"MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site"}]}}}