Graylog Web Interface version 2.2.3 contains a reflected XSS flaw due to missing output sanitization in several endpoints. The vulnerability allows an attacker to embed and execute arbitrary JavaScript in a victim’s browser when that user opens a specially crafted URL. The injected script can manipulate the user’s session context, potentially leading to session hijacking or other client‑side attacks.

The affected product is the Graylog Web Interface, specifically version 2.2.3. All earlier Graylog versions are considered obsolete and similarly vulnerable.

The CVSS base score is 5.3, indicating a moderate impact. The EPSS score is below 1 %, suggesting a very low probability that this flaw will be actively exploited. The vulnerability is not listed in the CISA KEV catalog. Attack vectors are inferred to be remote, browser‑based, requiring an end‑user to click or load a malicious link containing special characters or a script payload. If the attacker can also access the /system/authentication/users/edit/ endpoint, limited manipulation of the current user session may be possible. Overall risk to a system is moderate to low, but the presence of active users increases the potential compromise surface.