Description
In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts.
Remediation
References
https://www.graylog.org/post/announcing-the-release-of-graylog-2-4-6
https://github.com/Graylog2/graylog2-server/pull/4904
Related Vulnerabilities
CVE-2020-4077 Vulnerability in maven package org.webjars.npm:electron
CVE-2020-36640 Vulnerability in maven package org.bonitasoft.connectors:bonita-connector-webservice
CVE-2022-37265 Vulnerability in npm package steal
CVE-2023-26488 Vulnerability in npm package @openzeppelin/contracts-upgradeable
CVE-2023-47326 Vulnerability in maven package org.silverpeas.core:silverpeas-core