GraylogGHSA-h7g4-65mf-6mxh
Cross-site Scripting in Graylog Server
Medium6.1CVE-2018-11650 · Published May 14, 2022 · updated Nov 8, 2023
Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.graylog2:graylog2-server Maven | < 2.4.4 | 2.4.4 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- CVE-2018-11650
More Graylog advisories
All Graylog| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Feb 72024 | Graylog vulnerable to instantiation of arbitrary classes triggered by API request High8.8Feb 7, 2024 | High8.8 | 5.1.11+1 more |
| Jul 62023 | Graylog server has partial path traversal vulnerability in Support Bundle featureLow3.3Jul 6, 2023 | Low3.3 | 5.1.3 |
| Jul 62023 | Graylog vulnerable to insecure source port usage for DNS queriesLow3.7Jul 6, 2023 | Low3.7 | 5.0.9+1 more |
| Jul 62023 | Graylog user session is still usable after logoutLow2.6Jul 6, 2023 | Low2.6 | 5.0.9+1 more |
| May 142022 | Cross-site Scripting in GraylogMedium6.1May 14, 2022 | Medium6.1 | 2.4.4 |
| May 142022 | Cross-site Scripting in Graylog ServerMedium6.1May 14, 2022 | Medium6.1 | 2.4.6 |