CVE-2022-29529

An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field.

• CWE-79

• https://github.com/MISP/MISP/commit/9623de2f5cca011afc581d55cfa5ce87682894fdPatch, Third Party Advisory
• https://github.com/MISP/MISP/compare/v2.4.157...v2.4.158Release Notes, Third Party Advisory
• https://zigrin.com/advisories/misp-stored-xss-via-the-linotp-login-field/Third Party Advisory
• https://zigrin.com/cakephp-application-cybersecurity-research-protect-your-website-from-stored-xss-attacks-understanding-and-preventing-vulnerabilities-in-open-source-applications/Exploit, Third Party Advisory
• https://github.com/MISP/MISP/commit/9623de2f5cca011afc581d55cfa5ce87682894fdPatch, Third Party Advisory
• https://github.com/MISP/MISP/compare/v2.4.157...v2.4.158Release Notes, Third Party Advisory
• https://zigrin.com/advisories/misp-stored-xss-via-the-linotp-login-field/Third Party Advisory
• https://zigrin.com/cakephp-application-cybersecurity-research-protect-your-website-from-stored-xss-attacks-understanding-and-preventing-vulnerabilities-in-open-source-applications/Exploit, Third Party Advisory

Published

Apr 20, 2022

Last Modified

Jun 22, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29523Improper conditions check in the Open CAS software maintaine…5.5
• CVE-2022-29524Out-of-bounds write vulnerability exists in V-Server v4.0.11…7.8
• CVE-2022-29525Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 uses a hard-…9.8
• CVE-2022-29526Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Pri…5.3
• CVE-2022-29527Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a worl…7
• CVE-2022-29528An issue was discovered in MISP before 2.4.158. PHAR deseria…9.8
• CVE-2022-2953LibTIFF 4.4.0 has an out-of-bounds read in extractImageSecti…5.5
• CVE-2022-29530An issue was discovered in MISP before 2.4.158. There is sto…5.4
• CVE-2022-29531An issue was discovered in MISP before 2.4.158. There is sto…5.4
• CVE-2022-29532An issue was discovered in MISP before 2.4.158. There is XSS…4.8
• CVE-2022-29533An issue was discovered in MISP before 2.4.158. There is XSS…6.1
• CVE-2022-29534An issue was discovered in MISP before 2.4.158. In UsersCont…7.5