QOS.CH logback-core Server-Side Request Forgery vulnerability

GHSA-6v67-2wr5-gvf4 · CVE-2024-12801

Published Dec 19, 2024 · Modified Feb 4, 2026

Description

Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML.

The attacks involves the modification of DOCTYPE declaration in XML configuration files.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-12801
WEB https://github.com/qos-ch/logback/commit/5f05041cba4c4ac0a62748c5c527a2da48999f2d
PACKAGE https://github.com/qos-ch/logback
WEB https://logback.qos.ch/news.html#1.3.15
WEB https://logback.qos.ch/news.html#1.5.13

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes