hitoshura25/cvefixes huggingface dataset:
CVE-2023-28606 (JavaScript, published 2023-03-18T18:15Z)
Description: value: js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/webroot/js/event-graph.js
Commit message: fix: [security] XSS in event-graph node tooltips

- as reported by Cyber Controls from SIX Group


Vulnerable code:
                var labelHtml = label + '</br><i>' + escapeHtml(node.comment) + '</i>'
                    title: label,
                    title: label,
                label = node.type + ': ' + node.label;
                var labelHtml = label + '</br><i>' + escapeHtml(node.comment) + '</i>'
                        title: attr.object_relation + ': ' + attr.value,

Fixed code:
                var labelHtml = escapeHtml(label) + '</br><i>' + escapeHtml(node.comment) + '</i>'
                    title: escapeHtml(label),
                    title: escapeHtml(label),
                label = escapeHtml(node.type) + ': ' + node.label;
                var labelHtml = escapeHtml(label) + '</br><i>' + escapeHtml(node.comment) + '</i>'
                        title: escapeHtml(attr.object_relation) + ': ' + escapeHtml(attr.value),
CVE-2023-28607 (JavaScript, published 2023-03-18T18:15Z)
Description: value: js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/webroot/js/event-graph.js
Commit message: fix: [security] XSS in event-graph relationship tooltip



Vulnerable code:
                title: rel.comment,

Fixed code:
                title: escapeHtml(rel.comment),
CVE-2023-28884 (PHP, published 2023-03-27T03:15Z)
Description: value: In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/Lib/Tools/CustomPaginationTool.php
Commit message: fix: [security] XSS in community index

- As reported by Zigrin Security


Vulnerable code:

Fixed code:
        $params['page'] = is_numeric($params['page']) ? $params['page'] : 1;
        $params['limit'] = is_numeric($params['limit']) ? $params['limit'] : 60;
CVE-2023-37306 (PHP, published 2023-06-30T17:15Z)
Description: value: MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/ServersController.php
app/Lib/Tools/SyncTool.php
Commit message: fix: properly handle different cert file extensions in server sync. #9084


Vulnerable code:
                    $file = new File($server['Server'][$subm]['name']);
                    $ext = $file->ext();
                    // read pem file data
                    $pemData = FileAccessTool::readFromFile($server['Server'][$subm]['tmp_name'], $server['Server'][$subm]['size']);
                $pemData = base64_decode($server['Server'][$subm]);
            $dir = new Folder(APP . "files" . DS . "certs", true);
            $result = $pemfile->write($pemData);
                $params['ssl_cafile'] = APP . "files" . DS . "certs" . DS . $server[$model]['id'] . '.pem';
                $params['ssl_local_cert'] = APP . "files" . DS . "certs" . DS . $server[$model]['id'] . '_client.pem';

Fixed code:
            App::uses('SyncTool', 'Tools');

                    if (!is_uploaded_file($server['Server'][$subm]['tmp_name'])) {
                        throw new Exception(__('File not uploaded correctly'));
                    }

                    $ext = pathinfo($server['Server'][$subm]['name'], PATHINFO_EXTENSION);
                    if (!in_array($ext, SyncTool::ALLOWED_CERT_FILE_EXTENSIONS)) {
                        $this->Flash->error(__('Invalid extension.'));
                        $this->redirect(array('action' => 'index'));
                    }

                    // read certificate file data
                    $certData = FileAccessTool::readFromFile($server['Server'][$subm]['tmp_name'], $server['Server'][$subm]['size']);
                $ext = 'pem';
                $certData = base64_decode($server['Server'][$subm]);

            // check if the file is a valid x509 certificate
            try {
                $cert = openssl_x509_parse($certData);
                if (!$cert) {
                    throw new Exception(__('Invalid certificate.'));
                }
            } catch (Exception $e) {
                $this->Flash->error(__('Invalid certificate.'));
                $this->redirect(array('action' => 'index'));
            }

            $result = $pemfile->write($certData);

    const ALLOWED_CERT_FILE_EXTENSIONS = ['pem', 'crt'];

                $params['ssl_cafile'] = APP . "files" . DS . "certs" . DS . $server[$model]['cert_file'];
                $params['ssl_local_cert'] = APP . "files" . DS . "certs" . DS . $server[$model]['client_cert_file'];
CVE-2023-37307 (Other, published 2023-06-30T17:15Z)
Description: value: In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/CorrelationExclusions/top_correlations.ctp
app/View/Correlations/over_correlations.ctp
app/View/Correlations/top.ctp
app/View/Layouts/Emails/html/default.ctp
app/View/Layouts/default.ctp
app/View/Layouts/error.ctp
Commit message: fix: [layout:title] Make sure page title are correctly formatted


Vulnerable code:
            'title' => empty($ajax) ? $title_for_layout : false,
        'title' => empty($ajax) ? $title_for_layout : false,
            'title' => empty($ajax) ? $title_for_layout : false,
    <title><?php echo $title_for_layout;?></title>
    <title><?= $title_for_layout, ' - ', h(Configure::read('MISP.title_text') ?: 'MISP') ?></title>
        <?php echo $title_for_layout; ?>

Fixed code:
            'title' => empty($ajax) ? h($title_for_layout) : false,
        'title' => empty($ajax) ? h($title_for_layout) : false,
            'title' => empty($ajax) ? h($title_for_layout) : false,
    <title><?php echo h($title_for_layout);?></title>
    <title><?= h($title_for_layout), ' - ', h(Configure::read('MISP.title_text') ?: 'MISP') ?></title>
        <?php echo h($title_for_layout); ?>
CVE-2023-40224 (Other, published 2023-08-10T20:15Z)
Description: value: MISP 2.4.174 allows XSS in app/View/Events/index.ctp.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Events/index.ctp
Commit message: fix: [security] XSS in event index

- As reported by Marcos Rrodriguez S-V


Vulnerable code:
                            'onClickParams' => array($urlparams, 'events', 'filterEventIndex')

Fixed code:
                            'onClickParams' => array(h($urlparams), 'events', 'filterEventIndex')
CVE-2023-41098 (PHP, published 2023-08-23T06:15Z)
Description: value: An issue was discovered in MISP 2.4.174. In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon a dashboard edit.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/DashboardsController.php
Commit message: fix: [security] reflected xss on dashboard edit


Vulnerable code:

Fixed code:
            if (!empty($data['id']) && !preg_match('/^[\w\d_]+$/i', $data['id'])) {
                throw new BadRequestException(__('Invalid widget id provided.'));
            }
CVE-2023-48655 (PHP, published 2023-11-17T05:15Z)
Description: value: An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/Component/IndexFilterComponent.php
Commit message: fix: properly filter out query parameters


Vulnerable code:
            return in_array($paramName, $paramArray);

Fixed code:
            return in_array($paramName, $paramArray, true);
CVE-2023-48656 (PHP, published 2023-11-17T05:15Z)
Description: value: An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/Model/AppModel.php
Commit message: fix: fixed invalid ordering errors


Vulnerable code:

Fixed code:

    public function find($type = 'first', $query = array()) {
        if (!empty($query['order']) && $this->validOrderClause($query['order']) === false) {
            throw new InvalidArgumentException('Invalid order clause');
        }

        return parent::find($type, $query);
    }

    private function validOrderClause($order){
        $pattern = '/^[\w\_\-\.\(\) ]+$/';
        if(is_string($order) && preg_match($pattern, $order)){
            return true;
        }

        if (is_array($order)) {
            foreach ($order as $key => $value) {
                if (is_string($key) && is_string($value) && preg_match($pattern, $key) && in_array(strtolower($value), ['asc', 'desc'])) {
                    return true;
                }
                if(is_numeric($key) && is_string($value) && preg_match($pattern, $value)){
                    return true;
                }
            }
        }

        return false;
    }
CVE-2023-48657 (PHP, published 2023-11-17T05:15Z)
Description: value: An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/Model/AppModel.php
Commit message: chg: [restsearch internal] sanity check erroneous filters


Vulnerable code:
                        $temp['OR'][$key][] = -1;
                        if ($operator === 'NOT') {
                            $temp[] = array($key . ' NOT LIKE' => $f);
                        } else {
                            $temp[] = array($key . ' LIKE' => $f);
                            $temp[] = array($key => $f);
                        if ($operator === 'NOT') {
                            $temp[$key . ' !='][] = $f;
                        } else {
                            $temp['OR'][$key][] = $f;

Fixed code:
                        if ($this->checkParam($key)) {
                            $temp['OR'][$key][] = -1;
                        }
                        if ($this->checkParam($key)) {
                            if ($operator === 'NOT') {
                                $temp[] = array($key . ' NOT LIKE' => $f);
                            } else {
                                $temp[] = array($key . ' LIKE' => $f);
                                $temp[] = array($key => $f);
                            }
                        if ($this->checkParam($key)) {
                            if ($operator === 'NOT') {
                                $temp[$key . ' !='][] = $f;
                            } else {
                                $temp['OR'][$key][] = $f;
                            }
CVE-2023-48658 (PHP, published 2023-11-17T05:15Z)
Description: value: An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/Model/AppModel.php
Commit message: chg: [helper] Added param sanity check helper function

Vulnerable code:

Fixed code:

    public function checkParam($param)
    {
        return preg_match('/^[\w\_\-\. ]+$/', $param);
    }
CVE-2023-48659 (PHP, published 2023-11-17T05:15Z)
Description: value: An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/AppController.php
Commit message: fix: [internal] improved parameter parsing


Vulnerable code:
                    $data = array_merge($data, $request->data['request']);
                    $data = array_merge($data, $request->data);

Fixed code:
    private function __captureParam($data, $param, $value)
    {
        if ($this->modelClass->checkParam($param)) {
            $data[$param] = $value;
        }
        return $data;
    }

                    $temp = $request->data['request'];
                    $temp = $request->data;
                }
                if (empty($options['paramArray'])) {
                    foreach ($options['paramArray'] as $param => $value) {
                        $data = $this->__captureParam($data, $param, $value);
                    }
                    $data = array_merge($data, $temp);
                } else {
                    foreach ($options['paramArray'] as $param) {
                        if (isset($temp[$param])) {
                            $data[$param] = $temp[$param];
                        }
                    }
CVE-2023-49926 (PHP, published 2023-12-03T03:15Z)
Description: value: app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/Lib/Tools/EventTimelineTool.php
Commit message: security: [event:event-timeline] Fixed XSS in the event timeline widget

As reported by fukusuket(Fukusuke Takahashi)


Vulnerable code:
                    'content' => $attr['value'],
                    'content' => $obj['name'],
                    'meta-category' => $obj['meta-category'],
                        'content' => $obj_attr['value'],
                        'contentType' => $obj_attr['object_relation'],
                            'content' => $attribute['value'],
                            'content' => $attribute['value'],
                                'content' => $attribute['value'],
                                'content' => $attribute['value'],

Fixed code:
                    'content' => h($attr['value']),
                    'content' => h($obj['name']),
                    'meta-category' => h($obj['meta-category']),
                        'content' => h($obj_attr['value']),
                        'contentType' => h($obj_attr['object_relation']),
                            'content' => h($attribute['value']),
                            'content' => h($attribute['value']),
                                'content' => h($attribute['value']),
                                'content' => h($attribute['value']),
CVE-2023-50918 (PHP, published 2023-12-15T18:15Z)
Description: value: app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/AuditLogsController.php
Commit message: fix: [security] new audit logs lack of ACL controls

- added proper ACL handling to the new audit logs
- as reported by fukusuket(Fukusuke Takahashi)


Vulnerable code:

        $conditions = [];



Fixed code:
    private function __applyAuditACL(array $user)
    {
        $acl = [];
        if (empty($user['Role']['perm_site_admin'])) {
            if (!empty($user['Role']['perm_admin'])) {
                // ORG admins can see their own org info
                $acl = ['AuditLog.org_id' => $user['org_id']];
            } else {
                // users can see their own info
                $acl = ['AuditLog.user_id' => $user['id']];
            }
        }
        return $acl;
    }

        $acl = $this->__applyAuditACL($this->Auth->user());
        if ($acl) {
            $this->paginate['conditions']['AND'][] = $acl;
        }
        $conditions = [];
CVE-2024-25674 (PHP, published 2024-02-09T09:15Z)
Description: value: An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/OrganisationsController.php
Commit message: fix: [security] Improved security checks for organisation logo upload

- As reported by Andrei Agape / Teliacompany

Checks are:
- Maximum file size of 250K since the recommanded picture size is 48x48.
- File extension check
- File mime type checks


Vulnerable code:

Fixed code:
            if ($logo['size'] > 250*1024) {
                $this->Flash->error(__('This organisation logo is too large, maximum file size allowed is 250kB.'));
                return false;
            }

            if ($extension !== 'svg' && $extension !== 'png') {
                $this->Flash->error(__('Invalid file extension, Only PNG and SVG images are allowed.'));
                return false;
            }

            $imgMime = mime_content_type($logo['tmp_name']);
            if ($extension === 'png' && !exif_imagetype($logo['tmp_name'])) {
                $this->Flash->error(__('This is not a valid PNG image.'));
                return false;
            } else if ($extension === 'svg' && !($imgMime === 'image/svg+xml' || $imgMime === 'image/svg')) {
                $this->Flash->error(__('This is not a valid SVG image.'));
                return false;
            }
CVE-2024-25675 (PHP, published 2024-02-09T09:15Z)
Description: value: An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/JobsController.php
app/View/Events/export.ctp
Commit message: fix: [security] Enforce usage of POST to start an export generation process

As reported by Andrei Agape / Teliacompany


Vulnerable code:
                            '<button class="btn btn-inverse btn-small" id=button%s onClick="generate(\'%s\', \'%s\', \'%s\', \'%s\', \'%s\')" %s>%s</button>',
                            __('Generate')
            url: "<?php echo $baseurl; ?>/jobs/cache/" + type,

Fixed code:
        if (!$this->request->is('post')) {
            throw new MethodNotAllowedException('This endpoint only accept POST.');
        }
                            '<button class="btn btn-inverse btn-small" id=button%s onClick="generate(\'%s\', \'%s\', \'%s\', \'%s\', \'%s\')" %s>%s</button><div class="hidden">%s</div>',
                            __('Generate'),
                            $this->Form->postLink(__('Download'), array('controller' => 'jobs', 'action' => 'cache', h($k)), array('class' => 'btn btn-inverse btn-small')),
        var $clicked = $('#button'+i)
        var $form = $clicked.next().find('form')
            url: $form.attr('action'),
            type:'post',
            data: $form.serialize()
CVE-2024-29858 (PHP, published 2024-03-21T04:15Z)
Description: value: In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/OrganisationsController.php
Commit message: fix: [security] properly check for valid logo upload

- as kindly reported by Rémi Matasse and Raphael Lob from Synacktiv (https://www.synacktiv.com)


Vulnerable code:

            $imgMime = mime_content_type($logo['tmp_name']);
            if (!empty($logo['tmp_name']) && is_uploaded_file($logo['tmp_name'])) {
                return move_uploaded_file($logo['tmp_name'], APP . 'files/img/orgs/' . $filename);

Fixed code:
            $matches = null;
            $tmp_name = $logo['tmp_name'];
            if (preg_match_all('/[\w\/\-\.]*/', $tmp_name, $matches) && file_exists($logo['tmp_name'])) {
                $tmp_name = $matches[0][0];
                $imgMime = mime_content_type($tmp_name);
            } else {
                throw new NotFoundException(__('Invalid file.'));    
            }
            if (!empty($tmp_name) && is_uploaded_file($tmp_name)) {
                return move_uploaded_file($tmp_name, APP . 'files/img/orgs/' . $filename);