mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-28 17:21:36 +00:00
86 lines
3.4 KiB
JSON
86 lines
3.4 KiB
JSON
{
|
|
"id": "CVE-2024-12801",
|
|
"sourceIdentifier": "vulnerability@ncsc.ch",
|
|
"published": "2024-12-19T17:15:08.930",
|
|
"lastModified": "2025-01-03T14:15:24.500",
|
|
"vulnStatus": "Awaiting Analysis",
|
|
"cveTags": [],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12\u00a0 on the Java platform, allows an attacker to \nforge requests by compromising logback configuration files in XML.\n\n\n\nThe attacks involves the modification of DOCTYPE declaration in\u00a0 XML configuration files."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "Server-Side Request Forgery (SSRF) en SaxEventRecorder de QOS.CH logback versi\u00f3n 1.5.12 en la plataforma Java permite a un atacante falsificar solicitudes comprometiendo los archivos de configuraci\u00f3n de logback en XML. Los ataques implican la modificaci\u00f3n de la declaraci\u00f3n DOCTYPE en los archivos de configuraci\u00f3n XML."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV40": [
|
|
{
|
|
"source": "vulnerability@ncsc.ch",
|
|
"type": "Secondary",
|
|
"cvssData": {
|
|
"version": "4.0",
|
|
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:X/U:Clear",
|
|
"baseScore": 2.4,
|
|
"baseSeverity": "LOW",
|
|
"attackVector": "LOCAL",
|
|
"attackComplexity": "LOW",
|
|
"attackRequirements": "PRESENT",
|
|
"privilegesRequired": "LOW",
|
|
"userInteraction": "PASSIVE",
|
|
"vulnerableSystemConfidentiality": "LOW",
|
|
"vulnerableSystemIntegrity": "NONE",
|
|
"vulnerableSystemAvailability": "LOW",
|
|
"subsequentSystemConfidentiality": "HIGH",
|
|
"subsequentSystemIntegrity": "HIGH",
|
|
"subsequentSystemAvailability": "HIGH",
|
|
"exploitMaturity": "NOT_DEFINED",
|
|
"confidentialityRequirements": "NOT_DEFINED",
|
|
"integrityRequirements": "NOT_DEFINED",
|
|
"availabilityRequirements": "NOT_DEFINED",
|
|
"modifiedAttackVector": "NOT_DEFINED",
|
|
"modifiedAttackComplexity": "NOT_DEFINED",
|
|
"modifiedAttackRequirements": "NOT_DEFINED",
|
|
"modifiedPrivilegesRequired": "NOT_DEFINED",
|
|
"modifiedUserInteraction": "NOT_DEFINED",
|
|
"modifiedVulnerableSystemConfidentiality": "NOT_DEFINED",
|
|
"modifiedVulnerableSystemIntegrity": "NOT_DEFINED",
|
|
"modifiedVulnerableSystemAvailability": "NOT_DEFINED",
|
|
"modifiedSubsequentSystemConfidentiality": "NOT_DEFINED",
|
|
"modifiedSubsequentSystemIntegrity": "NOT_DEFINED",
|
|
"modifiedSubsequentSystemAvailability": "NOT_DEFINED",
|
|
"safety": "NOT_DEFINED",
|
|
"automatable": "NOT_DEFINED",
|
|
"recovery": "NOT_DEFINED",
|
|
"valueDensity": "DIFFUSE",
|
|
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
|
"providerUrgency": "CLEAR"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "vulnerability@ncsc.ch",
|
|
"type": "Secondary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-918"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://logback.qos.ch/news.html#1.3.15",
|
|
"source": "vulnerability@ncsc.ch"
|
|
},
|
|
{
|
|
"url": "https://logback.qos.ch/news.html#1.5.13",
|
|
"source": "vulnerability@ncsc.ch"
|
|
}
|
|
]
|
|
} |