Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2018-1285

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept a

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a Apache log4net

  • Apache log4net up to 2.0.8affected

References