CVSS 4.0
2.4 lowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/V:D/U:ClearCVE-2024-12801
Low (2.4). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in ch.qos.logback:logback-core 1.3.15, 1.5.13.
Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to
forge requests by compromising logback configuration files in XML.
The attacks involves the modification of DOCTYPE declaration in XML configuration files.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
- CWE
- CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6v67-2wr5-gvf4 | Maven | ch.qos.logback:logback-core | >=1.4.0 <1.5.13 | 1.5.13 |
| GHSA-6v67-2wr5-gvf4 | Maven | ch.qos.logback:logback-core | <1.3.15 | 1.3.15 |