Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5epss 0.3%
exploitation probability
0.3%top 77% of all CVEs
observed exploitation
nono source reports it
Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request composite display fields without verifying that every selected field is readable. A user can retrieve protected values, including the password hash on a readable user record; ordinary users are limited to their own permitted records, while administrators can retrieve hashes for all users. This issue is fixed in versions 7.1.4 and 7.2.0-alpha.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Affected products
Graylog2 · graylog2-serverReferences
https://github.com/Graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21https://github.com/Graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5https://github.com/Graylog2/graylog2-server/pull/26284https://github.com/Graylog2/graylog2-server/releases/tag/7.1.4https://github.com/Graylog2/graylog2-server/releases/tag/7.2.0-alpha.2https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-q79r-r9xg-r863