CVE-2024-24824
1 advisory.
Maven/org.graylog2:graylog2-server CVE-2024-24824: high 8.8
Graylog vulnerable to instantiation of arbitrary classes triggered by API request
Action: Upgrade org.graylog2:graylog2-server to 5.1.11 (5.1.x) or 5.2.4 (5.2.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0 | 5.1.11 | - |
| 5.2.0-alpha.1 | 5.2.4 | - |
Fixed versions
| 5.1.11 | 5.2.4 |
Sources
- osv: GHSA-p6gg-5hf4-4rgj
- https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-p6gg-5hf4-4rgj
- https://nvd.nist.gov/vuln/detail/CVE-2024-24824
- https://github.com/Graylog2/graylog2-server/commit/75ef2b8d60e7d67f859b79fe712c8ae7b2e861d8
- https://github.com/Graylog2/graylog2-server/commit/7f8ef7fa8edf493106d5ef6f777d4da02c5194d9
- https://github.com/Graylog2/graylog2-server
- https://github.com/Graylog2/graylog2-server/blob/e458db8bf4f789d4d19f1b37f0263f910c8d036c/graylog2-server/src/main/java/org/graylog2/rest/resources/system/ClusterConfigResource.java#L208-L214
CVE-2024-24824 · published · modified · JSON