CVE-2024-12801CWE-918

SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks

Low · published December 19, 2024

CVSS v4.0
2.4
EPSS
0%
Percentile
12.5
In the wild
Unconfirmed
What it is

Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12  on the Java platform, allows an attacker to

forge requests by compromising logback configuration files in XML.

The attacks involves the modification of DOCTYPE declaration in  XML configuration files.

The record
Technical detail
CVSS v4.0
2.4 · LOW
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/V:D/U:Clear
EPSS
0.00226 · 12.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2024-12-19T16:11Z
EPSS history
Timeline
  • 19 DEC 16:11Z
    SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks
    cvelistv5