Homepage
About Snyk

org.graylog2:graylog2-server@4.0.3 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.graylog2:graylog2-server package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Improper Access Control

org.graylog2:graylog2-server is a log management platform.

Affected versions of this package are vulnerable to Improper Access Control via the /api/system/cluster_config/ endpoint. An attacker can execute arbitrary code that is run during class instantiation by sending a specially crafted HTTP PUT request.

Note:

This is only exploitable if the attacker possesses the clusterconfigentry:create and clusterconfigentry:edit permissions, which are typically only granted to Admin users.

How to fix Improper Access Control?

Upgrade org.graylog2:graylog2-server to version 5.1.11, 5.2.4 or higher.

[2.0.0,5.1.11) [5.2.0-alpha.1,5.2.4)
  • M
Insecure Randomness

org.graylog2:graylog2-server is a log management platform.

Affected versions of this package are vulnerable to Insecure Randomness such that an external attacker could inject forged DNS responses into a Graylog's lookup table cache. Graylog seems to bind a single socket for outgoing DNS queries. That socket is bound to a random port number which is not changed again.

How to fix Insecure Randomness?

Upgrade org.graylog2:graylog2-server to version 5.0.9, 5.1.3 or higher.

[,5.0.9) [5.1.0,5.1.3)
  • M
Insufficient Session Expiration

org.graylog2:graylog2-server is a log management platform.

Affected versions of this package are vulnerable to Insufficient Session Expiration such that in a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. After a user has logged out, the UI shows the login screen again, which gives the user the impression that their session is not valid anymore. However, if the session becomes compromised later, it can still be used to perform API requests against the Graylog cluster. The time frame for this is limited to the configured session lifetime, starting from the time when the user logged out.

How to fix Insufficient Session Expiration?

Upgrade org.graylog2:graylog2-server to version 5.0.9, 5.1.3 or higher.

[1.0,5.0.9) [5.1.0,5.1.3)
Go back to all versions of this package