Saltar al contenido
QuenchWorks

VEXgraylog

graylog

1 declaración, emitidas el .Cada una es un hallazgo del escáner que no es explotable en esta imagen, y el motivo.

ImagenOpenVEX JSON

@id https://quench-works.com/vex/graylog/2026-11-05

  1. CVE-2026-56130

    no afectado · código vulnerable fuera de la ruta de ejecución
    • shiro-core 2.2.1

    Measured 2026-11-05 on a local build of graylog 7.1.12 (quench-graylog-7.1.12-r0.apk, /opt/graylog/graylog.jar). CVE-2026-56130 is the Shiro remember-me cookie not being checked for expiry on the server; the cookie handling is shiro-web's CookieRememberMeManager, installed by shiro-web's DefaultWebSecurityManager. graylog.jar ships 441 org/apache/shiro classes and no org/apache/shiro/web path at all (unzip -l), so neither class is in the image. shiro-core's DefaultSecurityManager only calls a RememberMeManager when one is set, and its default is null; a byte scan of every class in graylog.jar outside org/apache/shiro found 0 that reference RememberMe, so Graylog never sets one. The remember-me path cannot run. The fix is only in Shiro 3.0.0, a major line Graylog 7.1 does not use; revisit when Graylog moves to Shiro 3 or adds shiro-web.