GHSA-6v67-2wr5-gvf4

Source

https://github.com/advisories/GHSA-6v67-2wr5-gvf4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-6v67-2wr5-gvf4/GHSA-6v67-2wr5-gvf4.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-6v67-2wr5-gvf4

Aliases

CVE-2024-12801

Related

Published

2024-12-19T18:31:37Z

Modified

2025-01-03T19:09:24.645932Z

Severity

2.4 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/V:D/U:Clear CVSS Calculator

Summary

QOS.CH logback-core Server-Side Request Forgery vulnerability

Details

Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML.

The attacks involves the modification of DOCTYPE declaration in XML configuration files.

Database specific

{
    "nvd_published_at": "2024-12-19T17:15:08Z",
    "cwe_ids": [
        "CWE-918"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-19T22:22:44Z"
}

References

Affected packages

Maven / ch.qos.logback:logback-core

Package

Name: ch.qos.logback:logback-core; View open source insights on deps.dev
Purl: pkg:maven/ch.qos.logback/logback-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.4.0

Fixed

1.5.13

Affected versions

1.*

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

1.4.10

1.4.11

1.4.12

1.4.13

1.4.14

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.5.10

1.5.11

1.5.12

Maven / ch.qos.logback:logback-core

Package

Name: ch.qos.logback:logback-core; View open source insights on deps.dev
Purl: pkg:maven/ch.qos.logback/logback-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.15

Affected versions

0.*

0.2.5

0.3

0.5

0.6

0.7

0.7.1

0.8

0.8.1

0.9

0.9.1

0.9.2

0.9.3

0.9.4

0.9.5

0.9.6

0.9.7

0.9.8

0.9.9

0.9.10

0.9.11

0.9.12

0.9.13

0.9.14

0.9.15

0.9.16

0.9.17

0.9.18

0.9.19

0.9.20

0.9.21

0.9.22

0.9.23

0.9.24

0.9.25

0.9.26

0.9.27

0.9.28

0.9.29

0.9.30

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.0.10

1.0.11

1.0.12

1.0.13

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.1.10

1.1.11

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.4-groovyless

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.2.10

1.2.11

1.2.12

1.2.13

1.3.0-alpha0

1.3.0-alpha1

1.3.0-alpha2

1.3.0-alpha3

1.3.0-alpha4

1.3.0-alpha5

1.3.0-alpha6

1.3.0-alpha7

1.3.0-alpha8

1.3.0-alpha9

1.3.0-alpha10

1.3.0-alpha11

1.3.0-alpha12

1.3.0-alpha13

1.3.0-alpha14

1.3.0-alpha15

1.3.0-alpha16

1.3.0-beta0

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.3.9

1.3.10

1.3.11

1.3.12

1.3.13

1.3.14