GitHub Advisoryadvisory · Maven

GHSA-w77p-8cfg-2x43 Improper Access Control in SLF4J

CRITICAL Published 2022-05-13 Modified 2022-06-29 Official page ↗
Aliases
CVE-2018-8088
Ecosystem
Maven
Packages
org.slf4j:slf4j-ext
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284
Reviewed
2022-06-29

Affected packages

• Maven org.slf4j:slf4j-ext: < 1.7.26 → fixed in 1.7.26 • Maven org.slf4j:slf4j-ext: >= 1.8.0-alpha0, < 1.8.0-beta4 → fixed in 1.8.0-beta4

Description

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before `1.8.0-beta4` allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J version `1.7.26` and later and in the `2.0.x` series. Note that while the fix commit is associated with the tag `1.8.0-beta3`, the versions in Maven go directly from `1.8.0-beta2` to `1.8.0-beta4`.

Related

Alias · CVE (1)

  • CVE-2018-8088 org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References