Graylog: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• High 8.8
  CVE-2024-24824 Public exploit EPSS 35%

  graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request

  Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the `/api/system/cluster_config/` endpoint. Graylog's cluster co…

  Graylog2 graylog2-server org.graylog2:graylog2-server Maven
  Feb 7, 2024
• Medium 5.7
  CVE-2024-24823

  graylog2-server Session Fixation vulnerability through cookie injection

  Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with an existing session cookie would re-use that session id, even if for different user credentials. In this case, the pre-…

  Graylog2 graylog2-server org.graylog2:graylog2-server Maven
  Feb 7, 2024

Revision history

1. 2024-02-07 #1

   Initiale Fassung

References

• GitHub Advisory Database vom 2024-02-07
  https://github.com/advisories/GHSA-3xf8-g8gr-g7rh
• GitHub Advisory Database vom 2024-02-07
  https://github.com/advisories/GHSA-p6gg-5hf4-4rgj