CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2018-8088
Critical (9.8). EPSS 15% chance of exploitation in the next 30 days. Fixed in org.slf4j:slf4j-ext 1.7.26, 1.8.0-beta4.
org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.
Severity
- EPSS
- 15% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- oracle:goldengate_application_adapters
- oracle:goldengate_stream_analytics
- oracle:utilities_framework
- qos:slf4j
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_eus
- redhat:enterprise_linux_server
- redhat:enterprise_linux_server_aus
- redhat:enterprise_linux_server_tus
- redhat:enterprise_linux_workstation
- redhat:jboss_enterprise_application_platform
- redhat:virtualization
- redhat:virtualization_host
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-w77p-8cfg-2x43 | Maven | org.slf4j:slf4j-ext | <1.7.26 | 1.7.26 |
| GHSA-w77p-8cfg-2x43 | Maven | org.slf4j:slf4j-ext | >=1.8.0-alpha0 <1.8.0-beta4 | 1.8.0-beta4 |