AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

GraylogGHSA-38hf-xjmx-jrh8

Cross-site Scripting in Graylog Server

Graylog

CVE-2018-14380 · Published May 14, 2022 · updated Nov 8, 2023

Medium6.1
Fix: upgrade to 2.4.6 or later
GitHub advisory

In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts.

Affected versions

PackageAffectedFixed in
org.graylog2:graylog2-server
Maven
< 2.4.62.4.6
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-79
Also known as
CVE-2018-14380

More Graylog advisories

All Graylog
High 8.8Feb 7, 2024Graylog vulnerable to instantiation of arbitrary classes triggered by API requestCVE-2024-24824fixed in 5.1.11 +1Low 3.3Jul 6, 2023Graylog server has partial path traversal vulnerability in Support Bundle featureCVE-2023-41044fixed in 5.1.3Low 3.7Jul 6, 2023Graylog vulnerable to insecure source port usage for DNS queriesCVE-2023-41045fixed in 5.0.9 +1Low 2.6Jul 6, 2023Graylog user session is still usable after logoutCVE-2023-41041fixed in 5.0.9 +1Medium 6.1May 14, 2022Cross-site Scripting in GraylogCVE-2018-11651fixed in 2.4.4Medium 6.1May 14, 2022Cross-site Scripting in Graylog ServerCVE-2018-11650fixed in 2.4.4