Description

Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx.

Remediation

References

https://github.com/Graylog2/graylog2-server/pull/4739

https://www.graylog.org/post/announcing-graylog-v2-4-4

Related Vulnerabilities

CVE-2022-27263 Vulnerability in npm package strapi

CVE-2022-25210 Vulnerability in maven package com.convertigo.jenkins.plugins:convertigo-mobile-platform

CVE-2021-44138 Vulnerability in maven package com.caucho:resin

CVE-2022-36010 Vulnerability in npm package react-editable-json-tree

CVE-2023-4853 Vulnerability in maven package io.quarkus:quarkus-undertow

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Issue Tracking Patch Third Party Advisory Release Notes