Server-side Request Forgery (SSRF) Affecting ch.qos.logback:logback-core package, versions [,1.15.13)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Server-side Request Forgery (SSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JAVA-CHQOSLOGBACK-8539865
- published20 Dec 2024
- disclosed19 Dec 2024
- credit7asecurity
Introduced: 19 Dec 2024
NewCVE-2024-12801 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade ch.qos.logback:logback-core to version 1.15.13 or higher.
Overview
ch.qos.logback:logback-core is a logback-core module.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the SaxEventRecorder process. An attacker can forge requests by compromising logback configuration files in XML.