Reflected cross-site scripting flaw in Graylog Web Interface version 2.2.3 allows an attacker to inject malicious JavaScript into pages that include parts of a URL in their response. By constructing a specially crafted URL and tricking a user into visiting it, the attacker can run scripts in the victim’s browser, leading to execution of arbitrary client-side code and limited manipulation of the user’s session. The flaw arises from a failure to properly sanitize and escape HTML output when rendering the '/system/pipelines/' endpoint.

Graylog’s Web Interface console, version 2.2.3 (all preceding versions considered obsolete and insecure).

The vulnerability has a CVSS score of 5.3, indicating moderate severity, and an EPSS score of less than 1 %, suggesting a low probability of exploitation at the time of analysis. It is not listed in the CISA KEV catalog. Exploitation requires only a crafted link that a victim follows, making the attack vector straightforward. No attack prerequisites beyond normal web access are identified.