Cross-site Scripting in Graylog Server

GHSA-38hf-xjmx-jrh8 · CVE-2018-14380

Published May 14, 2022 · Modified Nov 8, 2023

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2018-14380
WEB https://github.com/Graylog2/graylog2-server/pull/4904
PACKAGE https://github.com/Graylog2/graylog2-server
WEB https://www.graylog.org/post/announcing-the-release-of-graylog-2-4-6

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes

Cross-site Scripting in Graylog Server

Description

References

More Maven vulnerabilities

Start Securing