CyberICT

CVE-2018-1285

Apache · Published May 11, 2020

CVSS v3.1

CRITICAL
Patch availableGet patch

Description

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

Affected Products

  • Log4net < 2.0.10
  • Fedora
  • Application Testing Suite
  • Hospitality Opera 5

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H