CVE-2024-12801

LOW EPSS 12.5%

Published Dec 19, 20241y ago · Modified Jun 17, 20261w ago

2.4 CVSS 4.0

Low

Published Dec 19, 2024 1y ago

Last Modified Jun 17, 2026 1w ago

Description

Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML. The attacks involves the modification of DOCTYPE declaration in XML configuration files.

CVSS Details

Base Score

2.4

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:X/U:Clear

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction P

Scope X

Threat Intelligence

EPSS Exploit Probability

12.5% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-918 Server-Side Request Forgery (SSRF) Validation

References 2

logback.qos.ch https://logback.qos.ch/news.html#1.3.15
logback.qos.ch https://logback.qos.ch/news.html#1.5.13

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.