netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-q7g5-jq6p-6wvx

Browse Source
This commit is contained in:
advisory-database[bot]
2025-05-07 15:05:35 +00:00
parent d86bbc4696
commit 2bf7a720bc
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/04/GHSA-q7g5-jq6p-6wvx/GHSA-q7g5-jq6p-6wvx.json
+2 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q7g5-jq6p-6wvx",
"modified": "2025-04-07T16:37:52Z",
"modified": "2025-05-07T15:03:32Z",
"published": "2025-04-07T16:37:52Z",
"aliases": [
"CVE-2025-30373"
],
"summary": "Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value",
"details": "### Impact\nStarting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless.\n\n### Patches\n\n### Workarounds\nDisabling http-based inputs and allow only authenticated pull-based inputs.\n\n### References",
"details": "### Impact\nStarting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless.\n\n### Patches\n\n### Workarounds\nDisabling http-based inputs and allow only authenticated pull-based inputs.\n\nAnalysis provided by Fabian Yamaguchi - Whirly Labs (Pty) Ltd",
"severity": [
{
"type": "CVSS_V3",