Graylog2 / Graylog2/graylog2-server
Minor security improvement: Prevention of software version exposure
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
We are running Graylog 3.3.8 in a project and recently made a security scan looking for vulnerabilities.
The scans showed that under the following endpoints...
/api/system
/api/system/jvm
/assets/builtins.4678e54c30f1075e4dd8.js
/assets/plugin/org.graylog.aws.AWSPlugin/plugin.org.graylog.aws.AWSPlugin.f2cd3046f5d8c08ce593.js
/api/
... information about the used software versions can be retrieved:
Generic: 3.3.8+e223f85
Linux: 3.10.0-1127.13.1.el7.x86_64
Oracle Java: 5
Underscore.js: 1.8.3
As the knowledge about used software versions potentially offers the chance to plan attacks against the software, I am reporting these insights so that security can be improved. This is of course a minor topic, even though the report is hopefully helpful to improve Graylog.
Contributor guide
Assessment
This issue has not been assessed yet.