CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCVE-2025-30373
Medium (5.3) in graylog graylog. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in org.graylog2:graylog2-server 6.1.9.
Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless. To mitigate the vulnerability, disable http-based inputs and allow only authenticated pull-based inputs. This vulnerability is fixed in 6.1.9.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
- CWE
- CWE-285
- Published
- Modified
- Record from
- the NVD, synced
Affected
- graylog:graylog
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-q7g5-jq6p-6wvx | Maven | org.graylog2:graylog2-server | >=6.1.0 <6.1.9 | 6.1.9 |