Security readout for executives and security teams
Plain-English summary
CVE-2021-37742 is a stored cross-site scripting issue in MISP 2.4.147. A malicious value can be saved and later executed when someone views galaxy cluster relationships. The bundle provides no CVSS score and no evidence of active exploitation, so urgency depends on whether your MISP instance is used by untrusted contributors or widely viewed internally.
Executive priority
Treat this as a targeted remediation item for MISP deployments, not an emergency without further evidence. Prioritize faster if MISP is shared broadly, accepts less-trusted data, or is used by privileged analysts in daily workflows.
Technical view
The vulnerable component is app/View/Elements/GalaxyClusters/view_relation_tree.ctp in MISP 2.4.147. The flaw is stored XSS triggered in the galaxy cluster relationship tree view. Public references include a MISP commit and a Zigrin advisory. The provided data does not state attacker prerequisites, affected versions beyond 2.4.147, or a CVSS vector.
Likely exposure
Exposure is most likely for organizations running MISP 2.4.147 where users view galaxy cluster relationships. Risk increases if less-trusted users or feeds can influence stored galaxy cluster relationship content. The supplied sources do not define exposure beyond MISP 2.4.147.
Exploitation context
The source bundle does not show KEV listing, active exploitation, public exploit use, or weaponized tooling. It only supports that stored XSS is possible when viewing galaxy cluster relationships in the identified MISP version.
Researcher notes
Evidence is narrow: stored XSS in a named MISP view, one commit reference, and one advisory. The bundle lacks CVSS, CWE, precise prerequisites, affected range, and confirmed exploit status. Avoid assuming broader MISP versions without vendor confirmation.
Mitigation direction
- Review and apply the MISP fix commit or a vendor release containing it.
- Check current MISP vendor guidance for the recommended patched version.
- Limit galaxy cluster editing to trusted users until remediation is complete.
- Review recent MISP user and content-change activity for suspicious stored values.
Validation and detection
- Inventory MISP instances and confirm whether version 2.4.147 is present.
- Verify whether the referenced MISP commit is included in deployed code.
- Identify users or feeds able to modify galaxy cluster relationship data.
- Confirm security testing covers the galaxy cluster relationship tree view.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-37742 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.