Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML.
The attacks involves the modification of DOCTYPE declaration in XML configuration files.
CVSS Details
- CVSS 4.0 Base Score: 2.4 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:X/U:Clear)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | no-fix-debian-deb-package | May 15, 2025 | Dec 19, 2024 | |
| Redhat_linux | — | no-fix-redhat-rpm-package | Jul 9, 2025 | Dec 19, 2024 |
| Suse | — | suse-upgrade-logbacksuse-upgrade-logback-accesssuse-upgrade-logback-examplessuse-upgrade-logback-javadoc | Jan 14, 2025 | Dec 19, 2024 |
| Ubuntu | no-fix-ubuntu-package | Jun 26, 2025 | Dec 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub