Skip to main content

Graylog CVE-2021-37760

CRITICAL
Insertion of Sensitive Information into Log File (CWE-532)
2021-07-31 cve@mitre.org
Information Disclosure Graylog
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jul 31, 2021 - 18:15 nvd
CRITICAL 9.8

DescriptionNVD

A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).

AnalysisAI

A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-532. A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID). Affected products include: Graylog. Version information: before 4.1.2.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Graylog

View all
CVE-2024-24824 HIGH POC
8.8 Feb 07

Graylog is a free and open log management platform. Rated high severity (CVSS 8.8), this vulnerability is remotely explo
CVE-2024-52506 HIGH POC
7.1 Nov 18

Graylog is a free and open log management platform. Rated high severity (CVSS 7.1), this vulnerability is remotely explo
CVE-2026-1435 CRITICAL
9.8 Feb 18

Improper session invalidation in Graylog Web Interface 2.2.3 allows attackers to maintain access through expired session
CVE-2021-37759 CRITICAL
9.8 Jul 31

A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access l
CVE-2023-41045 MEDIUM POC
5.3 Aug 31

Graylog is a free and open log management platform. Rated medium severity (CVSS 5.3), this vulnerability is remotely exp
CVE-2025-53106 HIGH
8.8 Jul 02

Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-
CVE-2020-15813 HIGH
8.1 Jul 17

Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. Rated high severity (CVSS 8.1), this vulnerabili
CVE-2025-46827 HIGH
8.0 May 07

Graylog is a free and open log management platform. Rated high severity (CVSS 8.0), this vulnerability is remotely explo
CVE-2023-41044 LOW POC
3.8 Aug 31

Graylog is a free and open log management platform. Rated low severity (CVSS 3.8), this vulnerability is remotely exploi
CVE-2023-41041 LOW POC
3.1 Aug 30

Graylog is a free and open log management platform. Rated low severity (CVSS 3.1), this vulnerability is remotely exploi
CVE-2025-30373 MEDIUM
6.5 Apr 07

Graylog is a free and open log management platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
CVE-2026-1436 MEDIUM
6.5 Feb 18

Graylog 2.2.3 contains an insecure direct object reference (IDOR) vulnerability in its user API endpoint that allows aut

Same weakness CWE-532 – Insertion of Sensitive Information into Log File

View all
CVE-2023-43261 HIGH POC
7.5
CVE-2025-24984 MEDIUM
4.6
CVE-2017-8075 CRITICAL POC
9.8
CVE-2017-8074 CRITICAL POC
9.8
CVE-2026-22778 CRITICAL POC
9.8
CVE-2019-17395 CRITICAL POC
9.8
CVE-2019-17398 CRITICAL POC
9.8
CVE-2019-17394 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2021-37760 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy