[org.graylog2:graylog2-server] Cross-site Scripting in Graylog Server

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.

References

• https://nvd.nist.gov/vuln/detail/CVE-2018-11650
• https://github.com/Graylog2/graylog2-server/pull/4727
• https://www.graylog.org/post/announcing-graylog-v2-4-4
• https://github.com/advisories/GHSA-h7g4-65mf-6mxh