GitHub Advisoryadvisory · Maven

GHSA-6v67-2wr5-gvf4 QOS.CH logback-core Server-Side Request Forgery vulnerability

LOW Published 2024-12-19 Modified 2025-01-03 Official page ↗
Aliases
CVE-2024-12801
Ecosystem
Maven
Packages
ch.qos.logback:logback-core
Severity
Low
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/V:D/U:Clear
Weaknesses
CWE-918
Reviewed
2024-12-19

Affected packages

• Maven ch.qos.logback:logback-core: >= 1.4.0, < 1.5.13 → fixed in 1.5.13 • Maven ch.qos.logback:logback-core: < 1.3.15 → fixed in 1.3.15

Description

Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML. The attacks involves the modification of DOCTYPE declaration in  XML configuration files.

Related

Alias · CVE (1)

  • CVE-2024-12801 Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform,… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References