The vulnerability is a reflected XSS flaw in the MISP workflow module. Parameter names returned by the misp‑modules service are rendered directly as HTML form labels without encoding. An attacker who can influence those parameter names can inject arbitrary HTML or JavaScript that runs in the browser of any authenticated user who views the affected page. This allows theft of session cookies, manipulation of the MISP interface, or execution of unauthorized actions on behalf of the user.

The issue affects MISP installations using the workflow module prior to version 2.5.48. Any system that exposes the misp‑modules service to an attacker or accepts untrusted input as parameter names is vulnerable. The vulnerability is specific to the MISP product, as listed by the CNA.

The CVSS score is 4.8, indicating a medium severity risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker’s ability to interfere with the misp‑modules service to supply malicious parameter names, plus the presence of an authenticated user who visits the workflow page. Because the attack vector depends on manipulation of an internal service and the need for a victim to be logged in, the likelihood of a widespread attack appears low, though it can be significant if the misp‑modules service is exposed to untrusted input.