NetSight
IP …
critical9.8

CVE-2018-1285

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files.

Impact

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

Affected products

VendorProductAffected versions
ApacheLog4net
before 2.0.10
FedoraprojectFedora
Versions 30, 31, 32
OracleApplication Testing Suite
Version 13.3.0.1
OracleHospitality Opera 5
Versions 5.5, 5.6
OracleHospitality Simphony
Versions 18.2.7.2, 19.1.3
NetappManageability Software Development Kit
All versions
NetappSnapcenter
All versions

Weakness classification

CWE-611

References