Description

In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts.

Remediation

References

https://github.com/Graylog2/graylog2-server/pull/4904

https://www.graylog.org/post/announcing-the-release-of-graylog-2-4-6

Related Vulnerabilities

CVE-2021-20218 Vulnerability in maven package io.fabric8:kubernetes-client

CVE-2018-8030 Vulnerability in maven package org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol

CVE-2020-6428 Vulnerability in npm package electron

CVE-2017-12619 Vulnerability in maven package org.apache.zeppelin:zeppelin

CVE-2018-1190 Vulnerability in maven package org.cloudfoundry.identity:cloudfoundry-identity-model

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Third Party Advisory Patch Release Notes Vendor Advisory CWE-79