From 45a7dadd889d370c0ef62b4edf80fddb9d0ca3bb Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Mon, 7 Dec 2020 08:54:29 +0100 Subject: [PATCH] chg: [security] CVE-2020-29572 added --- _pages/security.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/_pages/security.md b/_pages/security.md index 3eac271..2dabad8 100755 --- a/_pages/security.md +++ b/_pages/security.md @@ -60,6 +60,8 @@ We firmly believe that, even though unfortunately it is often not regarded as co - [CVE-2020-25766](https://cve.circl.lu/cve/CVE-2020-25766) <= MISP 2.4.131 - An issue was discovered in MISP before 2.4.132. It can perform an unwanted action because of a POST operation on a form that is not linked to the login page. - [CVE-2020-28043](https://cve.circl.lu/cve/CVE-2020-28043) <= MISP 2.4.133 - MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL. - [CVE-2020-28947](https://cve.circl.lu/cve/CVE-2020-28947) <= MISP 2.4.134 - In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled. +- [CVE-2020-29572](https://cve.circl.lu/cve/CVE-2020-29572)2) =< MISP 2.4.135 - app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field. + ## PGP Key