Skip to content
CVE PROGRAM SOURCE RECORD2.4 Low

CVE-2024-12801

SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
NCSC.ch

Description

Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12  on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML. The attacks involves the modification of DOCTYPE declaration in  XML configuration files.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

QOS.CH Sarl logback

Default version status: unaffected

  • 0.1 to ≤ 1.3.14affected
  • 1.4.0 to ≤ 1.5.12affected
  • 1.3.15unaffected
  • 1.5.13unaffected

References