Graylog Web Interface console 2.2.3 allows malicious scripts to run in user's browser

Summary

A security flaw in the Graylog Web Interface console allows an attacker to inject malicious code into the interface, potentially allowing them to take control of a user's session and manipulate their account. If you're using version 2.2.3 of the Graylog Web Interface, you should update to the latest version to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
graylog	graylog	2.2.3	–

Original title

Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints includ...

Original description

Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applying output encoding, allowing an attacker to inject and execute arbitrary JavaScript code when a user visits a specially crafted URL. Exploitation of this vulnerability may allow script execution in the victim's browser and limited manipulation of the affected user's session context, through the '/system/index_sets/' endpoint.

nvd CVSS3.1 6.1

nvd CVSS4.0 5.3

Vulnerability type

CWE-79 Cross-site Scripting (XSS)

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gray... Third Party Advisory