com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=6.1.0, <=6.1.7), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (6.1.0) +3 more potentially affected by CVE-2025-46827 via org.graylog2:graylog2-server (>=6.1.0, <=6.1.8)

org.graylog2:graylog2-server MAVEN version =6.1.0, =6.1.0, =6.1.0, =6.1.0, =6.1.0, =6.1.8 Source cves: CVE-2025-46827 Source advisory: SNYK:JAVA-ORGGRAYLOG2-10116752...

Cross-site Scripting (XSS)

Overview org.graylog2:graylog2-server is a log management platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Event Definition Remediation Step field. An attacker can obtain user session cookies by submitting an HTML form. Note: This is only exploitable ...

CVE-2025-46827

Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user account with...

CVE-2025-46827

Graylog has a vulnerability (CVE-2025-46827) where an HTML form in an Event Definition Remediation Step can leak user session cookies if an attacker has create-event-definition rights and the victim can view alerts, with an active input to receive form data. Affected versions are before 6.0.14, 6...

CVE-2025-46827 Graylog Allows Session Takeover via Insufficient HTML Sanitization

Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user account with...

CVE-2025-46827 Graylog Allows Session Takeover via Insufficient HTML Sanitization

Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user account with...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=6.1.0, <=6.1.7), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (6.1.0) +3 more potentially affected by CVE-2025-46827 via org.graylog2:graylog2-server (>=6.1.0, <=6.1.8)

org.graylog2:graylog2-server MAVEN version =6.1.0, =6.1.0, =6.1.0, =6.1.0, =6.1.0, =6.1.8 Source cves: CVE-2025-46827 Source advisory: MEND:CVE-2025-46827...

com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=1.1.0, <=4.1.1), com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=1.0.0, <=6.0.0) +12 more potentially affected by CVE-2025-46827 via org.graylog2:graylog2-server (>=1.0.0-beta.3, <=6.0.13)

org.graylog2:graylog2-server MAVEN version =1.0.0-beta.3, =1.1.0, =1.0.0, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1, =2.2.0-alpha.1, =1.1.0, =2.2.0-beta.1, =2.2.0-alpha.1, =1.0.3, =1.0.0-beta.2, =1.2.0-rc.1, =1.3.4 Source cves: CVE-2025-46827 Source advisory: MEND:CVE-2025-46827...

CVE-2025-46827 Graylog Allows Session Takeover via Insufficient HTML Sanitization

Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user account with...

CVE-2025-46827

Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user account with...

org.graylog.plugins:graylog-plugin-parent (4.1.8), org.graylog.plugins:graylog-plugin-web-parent (4.1.8) potentially affected by CVE-2025-46827 via org.graylog2:graylog2-server (4.1.8)

org.graylog2:graylog2-server MAVEN version 4.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 4.1.8 - org.graylog.plugins:graylog-plugin-web-parent 4.1.8...

org.graylog.plugins:graylog-plugin-parent (4.2.6), org.graylog.plugins:graylog-plugin-web-parent (4.2.6) potentially affected by CVE-2025-46827 via org.graylog2:graylog2-server (4.2.6)

org.graylog2:graylog2-server MAVEN version 4.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 4.2.6 - org.graylog.plugins:graylog-plugin-web-parent 4.2.6...

org.graylog.plugins:graylog-plugin-parent (3.1.3), org.graylog.plugins:graylog-plugin-web-parent (3.1.3) potentially affected by CVE-2025-46827 via org.graylog2:graylog2-server (3.1.3)

org.graylog2:graylog2-server MAVEN version 3.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 3.1.3 - org.graylog.plugins:graylog-plugin-web-parent 3.1.3...

org.graylog.plugins:graylog-plugin-parent (2.3.0), org.graylog.plugins:graylog-plugin-pipeline-processor (2.3.0) +2 more potentially affected by CVE-2025-46827 via org.graylog2:graylog2-server (2.3.0)

org.graylog2:graylog2-server MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 2.3.0 - org.graylog.plugins:graylog-plugin-pipeline-processor...

org.graylog.plugins:graylog-plugin-parent (4.0.3), org.graylog.plugins:graylog-plugin-web-parent (4.0.3) potentially affected by CVE-2025-46827 via org.graylog2:graylog2-server (4.0.3)

org.graylog2:graylog2-server MAVEN version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 4.0.3 - org.graylog.plugins:graylog-plugin-web-parent 4.0.3...

org.graylog.plugins:graylog-plugin-parent (3.3.0-beta.3), org.graylog.plugins:graylog-plugin-web-parent (3.3.0-beta.3) potentially affected by CVE-2025-46827 via org.graylog2:graylog2-server (3.3.0-beta.3)

org.graylog2:graylog2-server MAVEN version 3.3.0-beta.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 3.3.0-beta.3 -...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=4.4.0, <=4.5.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (4.2.0) +3 more potentially affected by CVE-2025-46827 via org.graylog2:graylog2-server (4.3.6)

org.graylog2:graylog2-server MAVEN version 4.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard =4.4.0, =4.2.0, =4.4.1 -...

org.graylog.plugins:graylog-plugin-parent (5.2.1), org.graylog.plugins:graylog-plugin-web-parent (5.2.1) potentially affected by CVE-2025-46827 via org.graylog2:graylog2-server (5.2.1)

org.graylog2:graylog2-server MAVEN version 5.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 5.2.1 - org.graylog.plugins:graylog-plugin-web-parent 5.2.1...

com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=4.1.0, <=4.1.1), com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=4.1.0, <=4.3.1) +4 more potentially affected by CVE-2025-46827 via org.graylog2:graylog2-server (4.2.3)

org.graylog2:graylog2-server MAVEN version 4.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (6.0.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (6.0.0) +3 more potentially affected by CVE-2025-46827 via org.graylog2:graylog2-server (>=6.0.0, <=6.0.13)

org.graylog2:graylog2-server MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.13 Source cves: CVE-2025-46827 Source advisory: GHSA-76VF-MPMX-777J...