The vulnerability originates from MISP's automatic XML decoding on all write requests; due to a logic error in the underlying Xml::build() library, a body that contains a bare HTTPS URL is interpreted as a locator and fetched by the server. The cspReport endpoint accepts XML content type and is intentionally unauthenticated, so an attacker can send a crafted XML payload that forces the server to issue an outbound HTTPS request. The attacker does not receive the response body, but can use timing or lack of response to probe internal services, trigger actions on internal HTTPS endpoints, or conduct network reconnaissance.

MISP deployments that expose the cspReport endpoint and have network access to internal or external HTTPS services. The problem exists in any MISP instance that has not applied the patch introducing XML input type validation in AppController::beforeFilter(). No specific product version is listed, so any current deployment is potentially vulnerable unless updated.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires only an unauthenticated HTTP POST with a crafted XML body, so attackers can easily trigger the blind SSRF. The lack of authentication on the cspReport endpoint makes the attack vector widely exploitable, and the server may reach internal networks behind firewalls, increasing the potential impact.