CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2024-24824 – graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request
https://notcve.org/view.php?id=CVE-2024-24824
07 Feb 2024 — Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the `/api/system/cluster_config/` endpoint. Graylog's cluster config system uses fully qualified class names as config keys. To validate the existence of the requested class before using them, Graylog loads the class using the class loader. If a user with the appropriate permissions performs the request, arbitrary c... • https://github.com/Graylog2/graylog2-server/blob/e458db8bf4f789d4d19f1b37f0263f910c8d036c/graylog2-server/src/main/java/org/graylog2/rest/resources/system/ClusterConfigResource.java#L208-L214 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 5.7EPSS: 0%CPEs: 2EXPL: 0CVE-2024-24823 – graylog2-server Session Fixation vulnerability through cookie injection
https://notcve.org/view.php?id=CVE-2024-24823
07 Feb 2024 — Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with an existing session cookie would re-use that session id, even if for different user credentials. In this case, the pre-existing session could be used to gain elevated access to an existing Graylog login session, provided the malicious user could successfully inject their session cookie into someone else's browser. The complexity of such an attack is high, because it req... • https://github.com/Graylog2/graylog2-server/commit/1596b749db86368ba476662f23a0f0c5ec2b5097 • CWE-384: Session Fixation •