Graylog API 2.2.3: Authorized Users Can Access Other Users' Profiles

Summary

An authenticated user can access other users' profiles in Graylog 2.2.3, potentially revealing sensitive information like names, email addresses, and activity history. This happens because the API doesn't properly check if a user is authorized to access certain data. As a Graylog administrator, update to the latest version of the software to fix this issue and protect user data.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
graylog	graylog	2.2.3	–

Original title

Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other user's profiles without proper authoriza...

Original description

Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other user's profiles without proper authorization checks. Exploiting this vulnerability allows valid users of the system to be listed and sensitive third-party information to be accessed, such as names, email addresses, internal identifiers, and last activity. The endpoint 'http://<IP>:12900/users/<my_user>' does not implement object-level authorization validations.

nvd CVSS3.1 6.5

nvd CVSS4.0 7.1

Vulnerability type

CWE-639 Authorization Bypass Through User-Controlled Key

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gray... Third Party Advisory