PT-2020-14644 · Graylog · Graylog

Published 2020-07-17 · Updated 2022-02-10 · CVE-2020-15813

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Graylog versions prior to 3.3.3

Description The issue concerns a lack of SSL Certificate Validation for LDAP servers, allowing an attacker to intercept network traffic between a Graylog server and an LDAP server. This enables the attacker to redirect traffic to a different LDAP server, effectively bypassing Graylog's authentication mechanism. The connection configuration allows the usage of unencrypted, SSL- or TLS-secured connections, but the Graylog client code does not implement proper certificate validation.

Recommendations For Graylog versions prior to 3.3.3, update to version 3.3.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the LDAP server or using additional authentication mechanisms to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-15813

GHSA-3GG9-F3VH-866F

Affected Products

Graylog

References · 5

• https://osv.dev/vulnerability/GHSA-3gg9-f3vh-866f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15813 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15813 · Vendor Advisory
• https://github.com/Graylog2/graylog2-server/issues/5906 · Note
• https://github.com/Graylog2/graylog2-server/pull/8569 · Note