PT-2024-17746 · Logback+2 · Logback+2

7Asecurity · CVE-2024-12801 · Published 2024-12-19 · Updated 2026-07-10

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions logback versions 0.1 through 1.3.14 logback versions 1.4.0 through 1.5.12

Description The issue allows an attacker to forge requests by compromising logback configuration files in XML. This is achieved by modifying the DOCTYPE declaration in XML configuration files, enabling Server-Side Request Forgery (SSRF) attacks.

Recommendations For logback versions 0.1 through 1.3.14, update to a version outside of this range to mitigate the risk. For logback versions 1.4.0 through 1.5.12, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting modifications to logback configuration files to prevent exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CLEANSTART-2026-CI66802

CLEANSTART-2026-DD05788

CLEANSTART-2026-GH89210

CLEANSTART-2026-KM27583

CLEANSTART-2026-SP91806

CLEANSTART-2026-VH41554

CLEANSTART-2026-XR78310

CVE-2024-12801

GHSA-6V67-2WR5-GVF4

OESA-2025-1082

OPENSUSE-SU-2025:14627-1

OPENSUSE-SU-2025_0072-1

SUSE-SU-2025:0072-1

Affected Products

Debian

Suse

Logback

References · 300

• https://nvd.nist.gov/vuln/detail/CVE-2026-1225 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-67735 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-13009 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44431 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-12801 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37136 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47554 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8908 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-XR78310 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25193 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3509 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-CI66802 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21634 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-27137 · Security Note