PT-2025-20234 · Graylog · Graylog

Fabian Yamaguchi · Published 2025-05-07 · Updated 2025-11-03 · CVE-2025-46827

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Graylog versions prior to 6.0.14 Graylog versions prior to 6.1.10 Graylog versions prior to 6.2.0

Description Graylog is a log management platform. An issue exists where user session cookies can be obtained by submitting an HTML form within an Event Definition Remediation Step field. To successfully exploit this, an attacker requires a user account with the ability to create event definitions and permissions to view alerts. An active Input capable of receiving form data, such as an HTTP input, TCP raw, or syslog, must also be present on the Graylog server.

Recommendations Graylog versions prior to 6.0.14 should be updated to version 6.0.14 or later. Graylog versions prior to 6.1.10 should be updated to version 6.1.10 or later. Graylog versions prior to 6.2.0 should be updated to version 6.2.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-46827

GHSA-76VF-MPMX-777J

Affected Products

Graylog

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46827.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-46827 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-76vf-mpmx-777j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46827 · Security Note
• https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-76vf-mpmx-777j · Note
• https://github.com/Graylog2/graylog2-server · Note
• https://t.me/cvedetector/24715 · Telegram Post
• https://t.me/cveNotify/141405 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1920180652328034308 · Twitter Post
• https://twitter.com/CVEnew/status/1920159114375610603 · Twitter Post