1129 matches found
Design/Logic Flaw
Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Each node maintains an in-memory cache of user sessions. Upon a cache-miss,...
CVE-2023-41041 User session is still usable after logout in graylog2-server
Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Each node maintains an in-memory cache of user sessions. Upon a cache-miss,...
CVE-2023-41041
CVE-2023-41041 concerns Graylog2-server where, in a multi-node cluster, a user session can remain valid for API requests after logout due to per-node session caching. When a user logs out, local caches are cleared and the database may delete the session, but other nodes retain a cached copy, allo...
CVE-2023-41041
Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Each node maintains an in-memory cache of user sessions. Upon a cache-miss,...
CVE-2023-41041 User session is still usable after logout in graylog2-server
Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Each node maintains an in-memory cache of user sessions. Upon a cache-miss,...
CVE-2023-41041 User session is still usable after logout in graylog2-server
Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Each node maintains an in-memory cache of user sessions. Upon a cache-miss,...
CVE-2023-41041: Insufficient Session Expiration
Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Each node maintains an in-memory cache of user sessions. Upon a cache-miss,...
Graylog code-related vulnerabilities
Graylog is a centralized log management solution from Graylog USA. The product supports capturing, storing, and analyzing logs in real-time, among other things. Graylog suffers from a code issue vulnerability that stems from the fact that in a multi-node Graylog cluster, after a user is explicitl...
GHSA-2Q4P-F6GF-MQR5 Graylog server has partial path traversal vulnerability in Support Bundle feature
A partial path traversal vulnerability exists in Graylog's Support Bundle feature. The vulnerability is caused by incorrect user input validation in an HTTP API resource. Thanks to weiweiwei9811 for reporting this vulnerability and providing detailed information. Impact Graylog's Support Bundle...
Graylog server has partial path traversal vulnerability in Support Bundle feature
A partial path traversal vulnerability exists in Graylog's Support Bundle feature. The vulnerability is caused by incorrect user input validation in an HTTP API resource. Thanks to weiweiwei9811 for reporting this vulnerability and providing detailed information. Impact Graylog's Support Bundle...
org.graylog.plugins:graylog-plugin-parent (>=5.1.0, <=5.1.2), org.graylog.plugins:graylog-plugin-web-parent (>=5.1.0, <=5.1.2) potentially affected by CVE-2023-41044 via org.graylog2:graylog2-server (>=5.1.0, <=5.1.2)
org.graylog2:graylog2-server MAVEN version =5.1.0, =5.1.0, =5.1.0, =5.1.2 Source cves: CVE-2023-41044 Source advisory: OSV:GHSA-2Q4P-F6GF-MQR5...
org.graylog.plugins:graylog-plugin-parent (>=5.1.0, <=5.1.2), org.graylog.plugins:graylog-plugin-web-parent (>=5.1.0, <=5.1.2) potentially affected by CVE-2023-41044 via org.graylog2:graylog2-server (>=5.1.0, <=5.1.2)
org.graylog2:graylog2-server MAVEN version =5.1.0, =5.1.0, =5.1.0, =5.1.2 Source cves: CVE-2023-41044 Source advisory: GHSA-2Q4P-F6GF-MQR5...
org.graylog.plugins:graylog-plugin-parent (3.2.0), org.graylog.plugins:graylog-plugin-web-parent (3.2.0) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (3.2.0)
org.graylog2:graylog2-server MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 3.2.0 - org.graylog.plugins:graylog-plugin-web-parent 3.2.0...
org.graylog.plugins:graylog-plugin-parent (2.2.0-beta.1), org.graylog.plugins:graylog-plugin-pipeline-processor (2.2.0-beta.1) +2 more potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (2.2.0-beta.1)
org.graylog2:graylog2-server MAVEN version 2.2.0-beta.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 2.2.0-beta.1 -...
org.graylog.plugins:graylog-plugin-parent (3.0.0-beta.2), org.graylog.plugins:graylog-plugin-web-parent (3.0.0-beta.2) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (3.0.0-beta.2)
org.graylog2:graylog2-server MAVEN version 3.0.0-beta.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 3.0.0-beta.2 -...
org.graylog.plugins:graylog-plugin-parent (2.4.5), org.graylog.plugins:graylog-plugin-pipeline-processor (2.4.5) +2 more potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (2.4.5)
org.graylog2:graylog2-server MAVEN version 2.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 2.4.5 - org.graylog.plugins:graylog-plugin-pipeline-processor...
org.graylog.plugins:graylog-plugin-parent (4.0.9), org.graylog.plugins:graylog-plugin-web-parent (4.0.9) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (4.0.9)
org.graylog2:graylog2-server MAVEN version 4.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 4.0.9 - org.graylog.plugins:graylog-plugin-web-parent 4.0.9...
org.graylog.plugins:graylog-plugin-parent (2.4.0-beta.1), org.graylog.plugins:graylog-plugin-pipeline-processor (2.4.0-beta.1) +2 more potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (2.4.0-beta.1)
org.graylog2:graylog2-server MAVEN version 2.4.0-beta.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 2.4.0-beta.1 -...
org.graylog.plugins:graylog-plugin-parent (2.4.4), org.graylog.plugins:graylog-plugin-pipeline-processor (2.4.4) +2 more potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (2.4.4)
org.graylog2:graylog2-server MAVEN version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 2.4.4 - org.graylog.plugins:graylog-plugin-pipeline-processor...
org.graylog.plugins:graylog-plugin-parent (4.0.13), org.graylog.plugins:graylog-plugin-web-parent (4.0.13) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (4.0.13)
org.graylog2:graylog2-server MAVEN version 4.0.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 4.0.13 - org.graylog.plugins:graylog-plugin-web-parent 4.0.1...