org.graylog2:graylog2-server (Maven)
Advisories
28
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 7.1.4 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.graylog2</groupId><artifactId>graylog2-server</artifactId><version>7.1.4</version></dependency>gradle
implementation("org.graylog2:graylog2-server:7.1.4")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-m9c2-85gv-8xr5 Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards |
Medium EPSS 0.42% |
>= 6.3.0, < 6.3.14 | 6.3.14 |
| GHSA-m9c2-85gv-8xr5 Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards |
Medium EPSS 0.42% |
>= 7.1.0, < 7.1.4 | 7.1.4 |
| GHSA-m9c2-85gv-8xr5 Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards |
Medium EPSS 0.42% |
>= 7.0.0, < 7.0.9 | 7.0.9 |
| GHSA-j769-9gv9-65gr Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens |
Medium EPSS 0.56% |
>= 7.1.0, < 7.1.2 | 7.1.2 |
| GHSA-j769-9gv9-65gr Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens |
Medium EPSS 0.56% |
>= 6.2.0, < 6.3.12 | 6.3.12 |
| GHSA-j769-9gv9-65gr Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens |
Medium EPSS 0.56% |
>= 7.0.0, < 7.0.7 | 7.0.7 |
| GHSA-gqr6-r77p-c2pj Fortigate syslog message parser can be exploited to modify or delete fields from the original message |
High EPSS 0.63% |
>= 7.0.0, < 7.0.7 | 7.0.7 |
| GHSA-gqr6-r77p-c2pj Fortigate syslog message parser can be exploited to modify or delete fields from the original message |
High EPSS 0.63% |
>= 7.1.0, < 7.1.2 | 7.1.2 |
| GHSA-gqr6-r77p-c2pj Fortigate syslog message parser can be exploited to modify or delete fields from the original message |
High EPSS 0.63% |
< 6.3.12 | 6.3.12 |
| GHSA-q79r-r9xg-r863 Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields |
Medium EPSS 0.41% |
>= 7.1.0, < 7.1.4 | 7.1.4 |
| GHSA-3m86-c9x3-vwm9 Graylog vulnerable to privilege escalation through API tokens |
High EPSS 0.61% |
>= 6.3.0-alpha.1, < 6.3.0-rc.2 | 6.3.0-rc.2 |
| GHSA-3m86-c9x3-vwm9 Graylog vulnerable to privilege escalation through API tokens |
High EPSS 0.61% |
>= 6.2.0, < 6.2.4 | 6.2.4 |
| GHSA-76vf-mpmx-777j Graylog Allows Session Takeover via Insufficient HTML Sanitization |
Medium EPSS 0.29% |
< 6.0.14 | 6.0.14 |
| GHSA-76vf-mpmx-777j Graylog Allows Session Takeover via Insufficient HTML Sanitization |
Medium EPSS 0.29% |
>= 6.1.0, < 6.1.10 | 6.1.10 |
| GHSA-q9q2-3ppx-mwqf Graylog Allows Stored Cross-Site Scripting via Files Plugin and API Browser |
High | < 6.2.0 | 6.2.0 |
| GHSA-q7g5-jq6p-6wvx Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value |
Medium EPSS 0.34% |
>= 6.1.0, < 6.1.9 | 6.1.9 |
| GHSA-p6gg-5hf4-4rgj Graylog vulnerable to instantiation of arbitrary classes triggered by API request |
High EPSS 34.74% |
>= 2.0.0, < 5.1.11 | 5.1.11 |
| GHSA-p6gg-5hf4-4rgj Graylog vulnerable to instantiation of arbitrary classes triggered by API request |
High EPSS 34.74% |
>= 5.2.0-alpha.1, < 5.2.4 | 5.2.4 |
| GHSA-3xf8-g8gr-g7rh Graylog session fixation vulnerability through cookie injection |
Medium EPSS 0.41% |
>= 5.2.0-alpha.1, < 5.2.4 | 5.2.4 |
| GHSA-3xf8-g8gr-g7rh Graylog session fixation vulnerability through cookie injection |
Medium EPSS 0.41% |
>= 4.3.0, < 5.1.11 | 5.1.11 |
| GHSA-2q4p-f6gf-mqr5 Graylog server has partial path traversal vulnerability in Support Bundle feature |
Low EPSS 0.70% |
>= 5.1.0, < 5.1.3 | 5.1.3 |
| GHSA-g96c-x7rh-99r3 Graylog vulnerable to insecure source port usage for DNS queries |
Medium EPSS 0.36% |
< 5.0.9 | 5.0.9 |
| GHSA-g96c-x7rh-99r3 Graylog vulnerable to insecure source port usage for DNS queries |
Medium EPSS 0.36% |
>= 5.1.0, < 5.1.3 | 5.1.3 |
| GHSA-3fqm-frhg-7c85 Graylog user session is still usable after logout |
Low EPSS 0.48% |
>= 5.1.0, < 5.1.3 | 5.1.3 |
| GHSA-3fqm-frhg-7c85 Graylog user session is still usable after logout |
Low EPSS 0.48% |
>= 1.0, < 5.0.9 | 5.0.9 |
| GHSA-435g-r2m8-gjvm Cross-site Scripting in Graylog |
Medium EPSS 0.80% |
< 2.4.4 | 2.4.4 |
| GHSA-h7g4-65mf-6mxh Cross-site Scripting in Graylog Server |
Medium EPSS 0.83% |
< 2.4.4 | 2.4.4 |
| GHSA-38hf-xjmx-jrh8 Cross-site Scripting in Graylog Server |
Medium EPSS 0.98% |
< 2.4.6 | 2.4.6 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor