Executive Summary

This vulnerability affects OpenCTI, an open source platform for managing cyber threat intelligence. Versions prior to 7.260227.0 are vulnerable to a Cross-Site Scripting (XSS) issue in the rendering of the email-message observable body data. Specifically, the content of the body field is not properly sanitized when displayed, which means malicious scripts could be executed if an attacker shares specially crafted data.

Exploitation requires user interaction, such as a user viewing the malicious content. The vulnerability could be exploited by someone sharing STIX data or through any ingester, potentially leading to Cross-Site Request Forgery (CSRF) and large scale session theft.

The issue was fixed in version 7.260227.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to significant security risks including Cross-Site Request Forgery (CSRF) attacks and large scale session theft. An attacker could exploit the XSS vulnerability to execute malicious scripts in the context of a victim's browser, potentially hijacking user sessions and gaining unauthorized access to sensitive information or functionalities within the OpenCTI platform.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade OpenCTI to version 7.260227.0 or later, as this version contains the fix for the XSS issue in the rendering of email-message observable body data.

Additionally, be cautious with user interactions involving shared STIX data or any ingester, as exploitation requires user interaction.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in OpenCTI allows for cross-site scripting (XSS) that can lead to cross-site request forgery (CSRF) and large scale session theft. Such security issues could potentially expose sensitive user data or session information.

However, the provided information does not specify any direct impact or implications regarding compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0