AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

GraylogGHSA-435g-r2m8-gjvm

Cross-site Scripting in Graylog

Graylog

CVE-2018-11651 · Published May 14, 2022 · updated Nov 8, 2023

Medium6.1
Fix: upgrade to 2.4.4 or later
GitHub advisory

Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx.

Affected versions

PackageAffectedFixed in
org.graylog2:graylog2-server
Maven
< 2.4.42.4.4
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-79
Also known as
CVE-2018-11651

More Graylog advisories

All Graylog
High 8.8Feb 7, 2024Graylog vulnerable to instantiation of arbitrary classes triggered by API requestCVE-2024-24824fixed in 5.1.11 +1Low 3.3Jul 6, 2023Graylog server has partial path traversal vulnerability in Support Bundle featureCVE-2023-41044fixed in 5.1.3Low 3.7Jul 6, 2023Graylog vulnerable to insecure source port usage for DNS queriesCVE-2023-41045fixed in 5.0.9 +1Low 2.6Jul 6, 2023Graylog user session is still usable after logoutCVE-2023-41041fixed in 5.0.9 +1Medium 6.1May 14, 2022Cross-site Scripting in Graylog ServerCVE-2018-11650fixed in 2.4.4Medium 6.1May 14, 2022Cross-site Scripting in Graylog ServerCVE-2018-14380fixed in 2.4.6