{"id":"CVE-2024-12801","state":"PUBLISHED","title":"SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks","description":"Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12  on the Java platform, allows an attacker to \nforge requests by compromising logback configuration files in XML.\n\n\n\nThe attacks involves the modification of DOCTYPE declaration in  XML configuration files.","publishedAt":"2024-12-19T16:11:50.044Z","updatedAt":"2025-01-03T13:40:41.135Z","severity":{"score":2.4,"label":"Low","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/V:D/U:Clear","source":"NCSC.ch"},"assigner":"NCSC.ch","products":["QOS.CH Sarl logback"],"affected":[{"vendor":"QOS.CH Sarl","product":"logback","defaultStatus":"unaffected","versions":[{"version":"0.1","status":"affected","lessThanOrEqual":"1.3.14","versionType":"maven"},{"version":"1.4.0","status":"affected","lessThanOrEqual":"1.5.12","versionType":"maven"},{"version":"1.3.15","status":"unaffected"},{"version":"1.5.13","status":"unaffected"}],"modules":["XML configuration component"],"platforms":["Java"]}],"references":["https://logback.qos.ch/news.html#1.5.13","https://logback.qos.ch/news.html#1.3.15"],"weaknesses":["CWE-918"],"ingestedAt":"2026-10-29T20:06:50.777Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/12xxx/CVE-2024-12801.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-12801","state":"PUBLISHED","datePublished":"2024-12-19T16:11:50.044Z","dateUpdated":"2025-01-03T13:40:41.135Z","assignerShortName":"NCSC.ch","assignerOrgId":"455daabc-a392-441d-aa46-37d35189897c","dateReserved":"2024-12-19T16:09:59.761Z"},"containers":{"cna":{"title":"SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks","descriptions":[{"lang":"en","value":"Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12  on the Java platform, allows an attacker to \nforge requests by compromising logback configuration files in XML.\n\n\n\nThe attacks involves the modification of DOCTYPE declaration in  XML configuration files."}],"affected":[{"vendor":"QOS.CH Sarl","product":"logback","defaultStatus":"unaffected","versions":[{"version":"0.1","status":"affected","lessThanOrEqual":"1.3.14","versionType":"maven"},{"version":"1.4.0","status":"affected","lessThanOrEqual":"1.5.12","versionType":"maven"},{"version":"1.3.15","status":"unaffected"},{"version":"1.5.13","status":"unaffected"}],"modules":["XML configuration component"],"platforms":["Java"]}],"references":[{"url":"https://logback.qos.ch/news.html#1.5.13"},{"url":"https://logback.qos.ch/news.html#1.3.15"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","baseScore":2.4,"baseSeverity":"LOW","privilegesRequired":"LOW","providerUrgency":"CLEAR","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/V:D/U:Clear","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"CWE-918 Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"NCSC.ch","orgId":"455daabc-a392-441d-aa46-37d35189897c","dateUpdated":"2025-01-03T13:40:41.135Z"},"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The attacker needs to access and write to logback configuration files. Alternatively, the attacker needs to be able to force the use of a malicious logback configuration file at application start.<br>"}],"value":"The attacker needs to access and write to logback configuration files. Alternatively, the attacker needs to be able to force the use of a malicious logback configuration file at application start."}],"credits":[{"lang":"en","type":"finder","value":"7asecurity"}],"exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"No known existing exploitation.<br>"}],"value":"No known existing exploitation."}],"impacts":[{"capecId":"CAPEC-212","descriptions":[{"lang":"en","value":"CAPEC-212 Functionality Misuse"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update to logback version 1.5.13 or later. If you are using the 1.3.x \nseries, update to logback version 1.3.15 or later. Note that the 1.4.x \nseries remains vulnerable.\n<br>"}],"value":"Update to logback version 1.5.13 or later. If you are using the 1.3.x \nseries, update to logback version 1.3.15 or later. Note that the 1.4.x \nseries remains vulnerable."}],"source":{"discovery":"EXTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update to logback version 1.5.13 or later. If you are using the 1.3.x \nseries, update to logback version 1.3.15 or later. Note that the 1.4.x \nseries remains vulnerable."}],"value":"Update to logback version 1.5.13 or later. If you are using the 1.3.x \nseries, update to logback version 1.3.15 or later. Note that the 1.4.x \nseries remains vulnerable."}],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-12-20T20:15:51.883590Z","id":"CVE-2024-12801","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-12-20T20:16:07.566Z"}}]}}}