AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

GraylogGHSA-h7g4-65mf-6mxh

Cross-site Scripting in Graylog Server

Graylog

CVE-2018-11650 · Published May 14, 2022 · updated Nov 8, 2023

Medium6.1
Fix: upgrade to 2.4.4 or later
GitHub advisory

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.

Affected versions

PackageAffectedFixed in
org.graylog2:graylog2-server
Maven
< 2.4.42.4.4
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-79
Also known as
CVE-2018-11650

More Graylog advisories

All Graylog
High 8.8Feb 7, 2024Graylog vulnerable to instantiation of arbitrary classes triggered by API requestCVE-2024-24824fixed in 5.1.11 +1Low 3.3Jul 6, 2023Graylog server has partial path traversal vulnerability in Support Bundle featureCVE-2023-41044fixed in 5.1.3Low 3.7Jul 6, 2023Graylog vulnerable to insecure source port usage for DNS queriesCVE-2023-41045fixed in 5.0.9 +1Low 2.6Jul 6, 2023Graylog user session is still usable after logoutCVE-2023-41041fixed in 5.0.9 +1Medium 6.1May 14, 2022Cross-site Scripting in GraylogCVE-2018-11651fixed in 2.4.4Medium 6.1May 14, 2022Cross-site Scripting in Graylog ServerCVE-2018-14380fixed in 2.4.6