CVE-2024-24824highCWE-284CWE-863

CVE-2024-24824: high-severity vulnerability in graylog2-server

graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request

Published · Updated

Follow this CVE+ Monitor graylog2-server+ Monitor org.graylog2:graylog2-server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 35%
Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the `/api/system/cluster_config/` endpoint. Graylog's cluster config system uses fully qualified class names as config keys. To validate the existence of the requested class before using them, Graylog loads the class using the class loader. If a user with the appropriate permissions performs the request, arbitrary classes with 1-arg String constructors can be instantiated. This will execute arbitrary code that is run during class instantiation. In the specific use case of `java.io.File`, the behavior of the internal web-server stack will lead to information exposure by including the entire file content in the response to the REST request. Versions 5.1.11 and 5.2.4 contain a fix for this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Graylog2 · graylog2-server
Related CVEs — graylog2-server

In the same product, most dangerous first.

CVE-2023-41044LOWPartial path traversal vulnerability in Support Bundle feature of GraylogEPSS 0.7%CVE-2026-55841HIGHGraylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original messageEPSS 0.6%CVE-2024-52506HIGHGraylog can leak other users' reports via concurrent PDF report renderingEPSS 0.6%CVE-2025-53106HIGHGraylog vulnerable to privilege escalation through API tokensEPSS 0.6%CVE-2026-55867MEDIUMGraylog token revocation endpoint allows authenticated users to delete other users’ access tokensEPSS 0.6%CVE-2023-41041LOWUser session is still usable after logout in graylog2-server EPSS 0.5%