Vulnerability: An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-controlled description.
Vulnerability ID: CVE-2022-25317
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/cerebrate-project/cerebrate
Published: 2022-02-18
File: templates/element/genericElements/Form/genericForm.php
Commit message: fix: [security] genericForm reflected XSS in form descriptions for user controlled descriptions

- accessible via the MISP local tool setting change
- sanitise the description

- as reported by Dawid Czarnecki from Zigrin Security
Commit author: iglocska

Vulnerable version (before fix):
                 '%s%s%s%s%s%s',                 empty($data['description']) ? '' : sprintf(                     '<div class="pb-2 fw-light">%s</div>',                     $data['description']                 ),                 $ajaxFlashMessage,                 $formCreate,             '%s%s%s%s%s%s',             empty($data['description']) ? '' : sprintf(                 '<div class="pb-2">%s</div>',                 $data['description']             ),             $ajaxFlashMessage,             $formCreate,             $ajaxFlashMessage,             empty($data['description']) ? '' : sprintf(                 '<div class="pb-3 fw-light">%s</div>',                 $data['description']             ),             sprintf('<div class="panel">%s</div>', $fieldsString),             empty($metaTemplateString) ? '' : $this->element(

Fixed version (after fix):
                 '%s%s%s%s%s%s',                 empty($data['description']) ? '' : sprintf(                     '<div class="pb-2 fw-light">%s</div>',                     h($data['description'])                 ),                 $ajaxFlashMessage,                 $formCreate,             '%s%s%s%s%s%s',             empty($data['description']) ? '' : sprintf(                 '<div class="pb-2">%s</div>',                 h($data['description'])             ),             $ajaxFlashMessage,             $formCreate,             $ajaxFlashMessage,             empty($data['description']) ? '' : sprintf(                 '<div class="pb-3 fw-light">%s</div>',                 h($data['description'])             ),             sprintf('<div class="panel">%s</div>', $fieldsString),             empty($metaTemplateString) ? '' : $this->element(

Patch:
patch: @@ -106,7 +106,7 @@
                 '%s%s%s%s%s%s',
                 empty($data['description']) ? '' : sprintf(
                     '<div class="pb-2 fw-light">%s</div>',
-                    $data['description']
+                    h($data['description'])
                 ),
                 $ajaxFlashMessage,
                 $formCreate,
@@ -131,7 +131,7 @@
             '%s%s%s%s%s%s',
             empty($data['description']) ? '' : sprintf(
                 '<div class="pb-2">%s</div>',
-                $data['description']
+                h($data['description'])
             ),
             $ajaxFlashMessage,
             $formCreate,
@@ -157,7 +157,7 @@
             $ajaxFlashMessage,
             empty($data['description']) ? '' : sprintf(
                 '<div class="pb-3 fw-light">%s</div>',
-                $data['description']
+                h($data['description'])
             ),
             sprintf('<div class="panel">%s</div>', $fieldsString),
             empty($metaTemplateString) ? '' : $this->element(
path: templates/element/genericElements/Form/genericForm.php