Description

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.

Remediation

References

https://github.com/Graylog2/graylog2-server/pull/4727

https://www.graylog.org/post/announcing-graylog-v2-4-4

Related Vulnerabilities

CVE-2020-28360 Vulnerability in npm package private-ip

CVE-2019-13173 Vulnerability in npm package fstream

CVE-2021-41084 Vulnerability in maven package org.http4s:http4s-server_3

CVE-2023-3635 Vulnerability in maven package com.squareup.okio:okio

CVE-2020-15779 Vulnerability in npm package socket.io-file

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Patch Third Party Advisory Release Notes