GitHub Advisoryadvisory · Maven

GHSA-435g-r2m8-gjvm Cross-site Scripting in Graylog

MEDIUM Published 2022-05-14 Modified 2022-11-04 Official page ↗
Aliases
CVE-2018-11651
Ecosystem
Maven
Packages
org.graylog2:graylog2-server
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-11-04

Affected packages

• Maven org.graylog2:graylog2-server: < 2.4.4 → fixed in 2.4.4

Description

Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx.

Related

Alias · CVE (1)

  • CVE-2018-11651 Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx,… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References