GHSA-m9c2-85gv-8xr5: Medium severity maven/org.graylog2:graylog2-server vulnerability
Impact
A vulnerability was found in Graylog's API endpoint for updating saved searches and dashboards. A user with edit permissions on a dashboard or saved search could grant owner permissions to an arbitrary account, which could then be used to delete the respective saved search or dashboard or to remove the original owner's access.
Patches
This issue has been patched in the following Graylog versions: 6.3.14, 7.0.9, 7.1.4. Affected users should upgrade to one of these versions or above to remediate the vulnerability.
Graylog Cloud has already been patched.
Workaround
There is no known workaround. Upgrading to a patched version is recommended.
Credits
Thanks to Jan Kahmen, turingpoint for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.graylog2:graylog2-serverto a version that resolves this vulnerability.Fixed in 7.1.4 - Upgrade
Upgrade
maven/org.graylog2:graylog2-serverto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
maven/org.graylog2:graylog2-serverto a version that resolves this vulnerability.Fixed in 6.3.14 - Upgrade
Upgrade
Graylogto a version that resolves this vulnerability.Fixed in 6.3.14 - Upgrade
Upgrade
Graylogto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
Graylogto a version that resolves this vulnerability.Fixed in 7.1.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Graylog user who has edit permissions on a dashboard or saved search can exploit it. The attacker can assign owner permissions for that specific resource to an arbitrary account.
What could an attacker do after exploiting it?
The account granted ownership can delete the affected saved search or dashboard. It can also remove the original owner's access to that resource.
Which deployments need remediation?
Graylog deployments using graylog2-server should upgrade to 6.3.14, 7.0.9, 7.1.4, or a later version. Graylog Cloud has already been patched.
Is there a workaround if an upgrade cannot be performed immediately?
No known workaround is available. Upgrading to a patched version is the recommended remediation.