Malware Information Sharing Platform CVE-2017-13671 HTML Injection Vulnerability
BID:100533
Info
Malware Information Sharing Platform CVE-2017-13671 HTML Injection Vulnerability
| Bugtraq ID: | 100533 |
| Class: | Input Validation Error |
| CVE: |
CVE-2017-13671 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 27 2017 12:00AM |
| Updated: | Aug 27 2017 12:00AM |
| Credit: | Jurgen Jans and Cedric Van Bockhaven from Deloitte. |
| Vulnerable: |
MISP Project Malware Information Sharing Platform 2.4.78 MISP Project Malware Information Sharing Platform 2.4.77 MISP Project Malware Information Sharing Platform 2.4.69 MISP Project Malware Information Sharing Platform 2.4.68 MISP Project Malware Information Sharing Platform 2.4.0 MISP Project Malware Information Sharing Platform 2.3.90 MISP Project Malware Information Sharing Platform 2.3.89 MISP Project Malware Information Sharing Platform 2.3.0 |
| Not Vulnerable: |
MISP Project Malware Information Sharing Platform 2.4.79 |
Discussion
Malware Information Sharing Platform CVE-2017-13671 HTML Injection Vulnerability
Malware Information Sharing Platform is prone to a HTML-injection vulnerability because it fails to sanitize user-supplied input.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
Versions prior to Malware Information Sharing Platform 2.4.79 are vulnerable.
Malware Information Sharing Platform is prone to a HTML-injection vulnerability because it fails to sanitize user-supplied input.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
Versions prior to Malware Information Sharing Platform 2.4.79 are vulnerable.
Exploit / POC
Malware Information Sharing Platform CVE-2017-13671 HTML Injection Vulnerability
An attacker can exploit this issue using a web browser.
An attacker can exploit this issue using a web browser.
Solution / Fix
Malware Information Sharing Platform CVE-2017-13671 HTML Injection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Malware Information Sharing Platform CVE-2017-13671 HTML Injection Vulnerability
References:
References: