Vulnerabilities in pkg:maven/org.graylog/graylog-parent
PACKAGECVE-2024-52506 is a HIGH graylog concurrent pdf report rendering vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) affecting Graylog parent libraries in the Maven ecosystem. The issue involves graylog concurrent pdf report rendering can leak other users' reports. Remediation is available by upgrading affected packages to version 6.1.2.
pkg:maven/org.graylog/graylog-parent
Vulnerability advisories affecting package pkg:maven/org.graylog/graylog-parent. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-vggm-3478-vm5m | CVE-2024-52506 | HIGH | Graylog concurrent PDF report rendering can leak other users' reports |
| GHSA-3gg9-f3vh-866f | CVE-2020-15813 | HIGH | Improper Certificate Validation in Graylog |
CVE-2024-52506 at a Glance
How to Fix CVE-2024-52506
To remediate this vulnerability, upgrade all affected Graylog parent dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
<dependency>
<groupId>org.graylog</groupId>
<artifactId>graylog-parent</artifactId>
<version>6.1.2</version>
</dependency>Run the following command in your project directory to verify that all resolved dependencies use the patched release:
mvn dependency:tree -Dincludes=org.graylogHow to Check if You Are Affected
To determine whether your Java application is affected by CVE-2024-52506, inspect your build dependencies using the Maven Dependency Plugin:
mvn dependency:tree -Dincludes=org.graylogAnalyze the terminal output to locate any version of Graylog parent in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 6.1.2), your application is affected.
Note: The mvn dependency:tree -Dincludes=org.graylog command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, where the product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. In Graylog parent, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2024-52506 Affected Graylog parent Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
org.graylog:graylog-parent
|
Maven |
≥ 6.1.0
< 6.1.2
|
6.1.2
|
References
Frequently Asked Questions
What is CVE-2024-52506?
Which Graylog parent versions are affected?
What version fixes CVE-2024-52506?
Is graylog-parent affected?
What CWE is associated with CVE-2024-52506?
How can I check Maven dependencies for CVE-2024-52506?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-vggm-3478-vm5m",
"modified" : "2025-09-23T21:34:23Z",
"published" : "2024-11-18T20:02:26Z",
"aliases" : [ "CVE-2024-52506" ],
"summary" : "Graylog concurrent PDF report rendering can leak other users' reports",
"details" : "### Impact\n\nThe reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboard widgets displaying individual log messages or metrics aggregated from fields of multiple log messages. This functionality, as included in Graylog 6.1.0 & 6.1.1, is vulnerable to information leakage triggered by multiple concurrent report rendering requests from authorized users.\n\nWhen multiple report renderings are requested at the same start time, the headless browser instance used to render the PDF will be reused. Depending on the timing, either a check for the browser instance \"freshness\" hits, resulting in an error instead of the report being returned, or one of the concurrent report rendering requests \"wins\" and this report is returned for all report rendering requests that do not return an error. This might lead to one user getting the report of a different user, potentially leaking indexed log messages or aggregated data that this user normally has no access to.\n\n### Patches\nThis problem is fixed in Graylog 6.1.2.\n\n### Workarounds\nThere is no known workaround besides disabling the reporting functionality.\n\n### References",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Maven",
"name" : "org.graylog:graylog-parent"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "6.1.0"
}, {
"fixed" : "6.1.2"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-vggm-3478-vm5m"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-52506"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/Graylog2/graylog2-server"
}, {
"type" : "WEB",
"url" : "https://www.vicarius.io/vsociety/posts/cve-2024-52506-detect-graylog-vulnerability"
}, {
"type" : "WEB",
"url" : "https://www.vicarius.io/vsociety/posts/cve-2024-52506-mitigate-graylog-vulnerability"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-200" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2024-11-18T20:02:26Z",
"nvd_published_at" : "2024-11-18T21:15:06Z"
}
}