cvelist/2024/12xxx/CVE-2024-12801.json

{
    "data_version": "4.0",
    "data_type": "CVE",
    "data_format": "MITRE",
    "CVE_data_meta": {
        "ID": "CVE-2024-12801",
        "ASSIGNER": "vulnerability@ncsc.ch",
        "STATE": "PUBLIC"
    },
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12\u00a0 on the Java platform, allows an attacker to \nforge requests by compromising logback configuration files in XML.\n\n\n\nThe attacks involves the modification of DOCTYPE declaration in\u00a0 XML configuration files."
            }
        ]
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "CWE-918 Server-Side Request Forgery (SSRF)",
                        "cweId": "CWE-918"
                    }
                ]
            }
        ]
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "vendor_name": "QOS.CH Sarl",
                    "product": {
                        "product_data": [
                            {
                                "product_name": "logback",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_value": "not down converted",
                                            "x_cve_json_5_version_data": {
                                                "versions": [
                                                    {
                                                        "lessThanOrEqual": "1.3.14",
                                                        "status": "affected",
                                                        "version": "0.1",
                                                        "versionType": "maven"
                                                    },
                                                    {
                                                        "lessThanOrEqual": "1.5.12",
                                                        "status": "affected",
                                                        "version": "1.4.0",
                                                        "versionType": "maven"
                                                    },
                                                    {
                                                        "status": "unaffected",
                                                        "version": "1.3.15"
                                                    },
                                                    {
                                                        "status": "unaffected",
                                                        "version": "1.5.13"
                                                    }
                                                ],
                                                "defaultStatus": "unaffected"
                                            }
                                        }
                                    ]
                                }
                            }
                        ]
                    }
                }
            ]
        }
    },
    "references": {
        "reference_data": [
            {
                "url": "https://logback.qos.ch/news.html#1.5.13",
                "refsource": "MISC",
                "name": "https://logback.qos.ch/news.html#1.5.13"
            },
            {
                "url": "https://logback.qos.ch/news.html#1.3.15",
                "refsource": "MISC",
                "name": "https://logback.qos.ch/news.html#1.3.15"
            }
        ]
    },
    "generator": {
        "engine": "Vulnogram 0.2.0"
    },
    "source": {
        "discovery": "EXTERNAL"
    },
    "configuration": [
        {
            "lang": "en",
            "supportingMedia": [
                {
                    "base64": false,
                    "type": "text/html",
                    "value": "The attacker needs to access and write to logback configuration files. Alternatively, the attacker needs to be able to force the use of a malicious logback configuration file at application start.<br>"
                }
            ],
            "value": "The attacker needs to access and write to logback configuration files. Alternatively, the attacker needs to be able to force the use of a malicious logback configuration file at application start."
        }
    ],
    "work_around": [
        {
            "lang": "en",
            "supportingMedia": [
                {
                    "base64": false,
                    "type": "text/html",
                    "value": "Update to logback version 1.5.13 or later. If you are using the 1.3.x \nseries, update to logback version 1.3.15 or later. Note that the 1.4.x \nseries remains vulnerable."
                }
            ],
            "value": "Update to logback version 1.5.13 or later. If you are using the 1.3.x \nseries, update to logback version 1.3.15 or later. Note that the 1.4.x \nseries remains vulnerable."
        }
    ],
    "exploit": [
        {
            "lang": "en",
            "supportingMedia": [
                {
                    "base64": false,
                    "type": "text/html",
                    "value": "No known existing exploitation.<br>"
                }
            ],
            "value": "No known existing exploitation."
        }
    ],
    "solution": [
        {
            "lang": "en",
            "supportingMedia": [
                {
                    "base64": false,
                    "type": "text/html",
                    "value": "Update to logback version 1.5.13 or later. If you are using the 1.3.x \nseries, update to logback version 1.3.15 or later. Note that the 1.4.x \nseries remains vulnerable.\n<br>"
                }
            ],
            "value": "Update to logback version 1.5.13 or later. If you are using the 1.3.x \nseries, update to logback version 1.3.15 or later. Note that the 1.4.x \nseries remains vulnerable."
        }
    ],
    "credits": [
        {
            "lang": "en",
            "value": "7asecurity"
        }
    ]
}