GitHub Advisoryadvisory · Maven

GHSA-q7g5-jq6p-6wvx Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value

MEDIUM Published 2025-04-07 Modified 2025-05-07 Official page ↗
Aliases
CVE-2025-30373
Ecosystem
Maven
Packages
org.graylog2:graylog2-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-285
Reviewed
2025-04-07

Affected packages

• Maven org.graylog2:graylog2-server: >= 6.1.0, < 6.1.9 → fixed in 6.1.9

Description

Impact Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless. Patches Workarounds Disabling http-based inputs and allow only authenticated pull-based inputs. Analysis provided by Fabian Yamaguchi - Whirly Labs (Pty) Ltd

Related

Alias · CVE (1)

  • CVE-2025-30373 Graylog is a free and open log management platform. vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References