Description

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.

Remediation

References

https://www.graylog.org/post/announcing-graylog-v2-4-4

https://github.com/Graylog2/graylog2-server/pull/4727

Related Vulnerabilities

CVE-2023-26134 Vulnerability in npm package git-commit-info

CVE-2022-41404 Vulnerability in maven package org.ini4j:ini4j

CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.ihc

CVE-2023-26048 Vulnerability in maven package org.eclipse.jetty:jetty-server

CVE-2021-41164 Vulnerability in npm package ckeditor4

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Release Notes Patch Third Party Advisory