CVE-2018-1285
- State
- Published
- Severity
- Not scored
- Published
- May 11, 2020
- Updated
- Aug 5, 2024
- Reserved
- Dec 7, 2017
Description
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Apache log4netn/a |
|
References
- FEDORA-2020-cfc319e067vendor-advisory
- FEDORA-2020-73d380e9b9vendor-advisory
- FEDORA-2020-847775bf79vendor-advisory
- [logging-dev] 20200525 [CVE-2018-1285] XXE vulnerability in Apache log4netmailing-list
- [logging-dev] 20200525 Re: [CVE-2018-1285] XXE vulnerability in Apache log4netmailing-list
- [logging-dev] 20200617 Re: [CVE-2018-1285] XXE vulnerability in Apache log4netmailing-list
- [logging-dev] 20200730 Re: [CVE-2018-1285] XXE vulnerability in Apache log4netmailing-list
- [logging-dev] 20200826 log4net.dll - does 2.0.9 fix CVE-2018-1285mailing-list
- [logging-dev] 20200826 Re: log4net.dll - does 2.0.9 fix CVE-2018-1285mailing-list
- [logging-dev] 20200906 [VOTE] [log4net] Release 2.0.10mailing-list
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://lists.apache.org/thread.html/reab1c277c95310bad1038255e0757857b2fbe291411b4fa84552028a%40%3Cdev.logging.apache.org%3E
- https://issues.apache.org/jira/browse/LOG4NET-575
- https://www.oracle.com/security-alerts/cpuApr2021.html
- [logging-dev] 20210817 Solution for vulnerabilitymailing-list
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220909-0001/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.