CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2018-1285

CVSS 9.8v3.1pub. 2020-05-11upd. 2024-11-21

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Apache Log4net

    APP
    Apache
    < 2.0.10

  • Fedora Project Fedora

    OS
    Fedoraproject
    303132

  • Netapp Manageability Software Development Kit

    APP
    Netapp
    all versions

  • Netapp Snapcenter

    APP
    Netapp
    all versions

  • Oracle Application Testing Suite

    APP
    Oracle
    13.3.0.1

  • Oracle Hospitality Opera 5

    APP
    Oracle
    5.55.6

  • Oracle Hospitality Simphony

    APP
    Oracle
    18.2.7.219.1.3
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
XXE
CWE
References

Related vulnerabilities

CVE-2024-4577CRITICAL9.8⚠ KEVPL ✓same product

PHP CGI argument injection – RCE na Windows przez mechanizm Best-Fit

CVE-2024-5274CRITICAL9.6⚠ KEVPL ✓same product

Type Confusion w V8 (Google Chrome) — RCE przez spreparowaną stronę HTML

CVE-2024-4947CRITICAL9.6⚠ KEVPL ✓same product

Type Confusion w silniku V8 Chrome — zdalne wykonanie kodu (RCE)

CVE-2024-4671CRITICAL9.6⚠ KEVPL ✓same product

Use-after-free w Google Chrome Visuals umożliwiający ucieczkę z sandbox

CVE-2023-6345CRITICAL9.6⚠ KEVPL ✓same product

Integer overflow w Skia w Google Chrome — sandbox escape