The vulnerability resides in the Graylog Web Interface version 2.2.3, where input from the URL is reflected in the HTML response without proper sanitization. An attacker can craft a URL that injects malicious JavaScript, which will run in the victim's browser and can potentially hijack or tamper with their session context when they visit the /alerts/ endpoint.

Graylog Web Interface, version 2.2.3.

The CVSS score of 5.3 indicates a moderate impact. The EPSS score of less than 1% suggests a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, so no confirmed exploits are publicly known. Exploitation requires the victim to open a crafted link, so the attack vector is primarily through phishing or social engineering. Once executed, the script runs with the privileges of the logged‑in user.