{"answers":{"affected":"2 open source packages ship an affected version, including org.graylog:graylog-parent. It affects 1 product.","exploited":"There is no known exploitation of CVE-2024-52506 in the wild and no public exploit code.","fix":"Upgrade org.graylog:graylog-parent to 6.1.2 or later.","what":"CVE-2024-52506 is a high-severity vulnerability in graylog2-server, published on 18 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-52506 and fix it if it is affected.\n\nWhat it is: CVE-2024-52506 is a high-severity vulnerability in graylog2-server, published on 18 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-52506 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- org.graylog:graylog-parent (Maven): affected from 6.1.0; fixed in 6.1.2\n- org.graylog:graylog-parent (Maven): affected from 6.1.0; fixed in 6.1.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-52506/ (Markdown: https://insights.sbomify.com/CVE-2024-52506/index.md)","id":"CVE-2024-52506","markdown":"https://insights.sbomify.com/CVE-2024-52506/index.md","name":"CVE-2024-52506","record":{"aliases":["GHSA-vggm-3478-vm5m"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Graylog log management","requires_auth":"low_privilege","summary":"Concurrent report rendering in Graylog may leak other users' log data due to a race condition in browser instance reuse.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"graylog","vendor":"graylog"}],"cvss":{"score":7.1,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"description":"Graylog is a free and open log management platform. The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboard widgets displaying individual log messages or metrics aggregated from fields of multiple log messages. This functionality, as included in Graylog 6.1.0 \u0026 6.1.1, is vulnerable to information leakage triggered by multiple concurrent report rendering requests from authorized users. When multiple report renderings are requested at the same start time, the headless browser instance used to render the PDF will be reused. Depending on the timing, either a check for the browser instance \"freshness\" hits, resulting in an error instead of the report being returned, or one of the concurrent report rendering requests \"wins\" and this report is returned for all report rendering requests that do not return an error. This might lead to one user getting the report of a different user, potentially leaking indexed log messages or aggregated data that this user normally has no access to. This problem is fixed in Graylog 6.1.2. There is no known workaround besides disabling the reporting functionality.","ecosystems":["Maven"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Graylog can leak other users' reports via concurrent PDF report rendering","id":"CVE-2024-52506","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":null,"products":[],"type":"race_condition","year":"2024"},"n_packages":2,"n_references":1,"next":{"headline":"Share information of the Nextcloud Tables app is not limited to affected users","id":"CVE-2024-52507"},"packages":[{"ecosystem":"Maven","fixed":["6.1.2"],"introduced":["6.1.0"],"last_affected":[],"package":"org.graylog:graylog-parent","purl":null,"source":"GHSA-vggm-3478-vm5m"},{"ecosystem":"Maven","fixed":["6.1.2"],"introduced":["6.1.0"],"last_affected":[],"package":"org.graylog:graylog-parent","purl":"pkg:maven/org.graylog/graylog-parent","source":"GHSA-vggm-3478-vm5m"}],"prev":{"headline":"matrix-appservice-irc allows IRC Command injection in provisioning API","id":"CVE-2024-52505"},"products":["graylog2-server"],"published":"2024-11-18","related":[{"cvss_score":9.8,"headline":"Information disclosure in n/a","id":"CVE-2021-37759","kev_date_added":null,"published":"2021-07-31"},{"cvss_score":9.8,"headline":"Information disclosure in n/a","id":"CVE-2021-37760","kev_date_added":null,"published":"2021-07-31"},{"cvss_score":9.3,"headline":"Incorrect management of session invalidation vulnerability in Graylog Web Interface","id":"CVE-2026-1435","kev_date_added":null,"published":"2026-02-18"},{"cvss_score":8.8,"headline":"Graylog vulnerable to privilege escalation through API tokens","id":"CVE-2025-53106","kev_date_added":null,"published":"2025-07-02"},{"cvss_score":8.8,"headline":"graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request","id":"CVE-2024-24824","kev_date_added":null,"published":"2024-02-07"},{"cvss_score":8.1,"headline":"Improper Certificate Validation in Graylog","id":"CVE-2020-15813","kev_date_added":null,"published":"2020-07-17"},{"cvss_score":8,"headline":"Graylog Allows Session Takeover via Insufficient HTML Sanitization","id":"CVE-2025-46827","kev_date_added":null,"published":"2025-05-07"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-09-23","vendors":["Graylog2"]},"summary":"Concurrent report rendering in Graylog may leak other users' log data due to a race condition in browser instance reuse.","url":"https://insights.sbomify.com/CVE-2024-52506/"}