Security readout for executives and security teams
Plain-English summary
MISP 2.4.134 has a cross-site scripting issue in a template element index page. A mishandled id parameter could allow script execution in another user's browser within the MISP web interface. The public bundle does not provide CVSS, affected ranges beyond 2.4.134, or active exploitation evidence.
Executive priority
Treat this as a targeted application-security remediation item, not an emergency based on current evidence. Prioritize MISP environments because they may contain sensitive threat-intelligence data and trusted-user workflows.
Technical view
CVE-2020-28947 is an XSS flaw in MISP 2.4.134 affecting the template element index view through improper handling of the id parameter. The cited upstream commit is the only remediation reference in the bundle. No CWE, CVSS vector, or exploit prerequisites are provided.
Likely exposure
Exposure is likely limited to organizations running MISP 2.4.134 and allowing users to access the affected template element index view. The bundle does not identify other affected versions, deployment modes, or required privileges.
Exploitation context
The source bundle and KEV flag do not support active exploitation claims. Practical impact depends on whether an attacker can place or induce a crafted id value that a logged-in MISP user opens in the vulnerable view.
Researcher notes
The public record is sparse: no CVSS, CWE, exploit status, or complete affected-version range is provided. Analysis should stay anchored to MISP 2.4.134 and the referenced commit unless vendor advisories add detail.
Mitigation direction
- Inventory MISP instances and confirm whether version 2.4.134 is present.
- Check MISP vendor guidance for the fixed release containing the referenced commit.
- Upgrade or apply the upstream fix through normal change control.
- Restrict MISP administrative and template access to trusted users only.
- Review web logs for unusual requests to template element index views.
Validation and detection
- Confirm the deployed MISP version and build commit.
- Verify whether commit 626ca544ffb5604ea01bb291f69811668b6b5631 is present.
- Review access controls for users who can reach template element pages.
- Check security monitoring for suspicious template element index requests.
- Document whether compensating controls limit user interaction with the affected view.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-28947 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/MISP/MISP/commit/626ca544ffb5604ea01bb291f69811668b6b5631CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.