PT-2025-40064 · Unknown+2 · Logback-Core+3
CVSS v4.0
7.0
High
| Vector | AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green |
Name of the Vulnerable Software and Affected Versions
logback-core versions up to and including 1.5.18
Description
A flaw exists in the conditional configuration file processing within logback-core, potentially allowing an attacker to execute arbitrary code. This is possible by compromising an existing logback configuration file or injecting a malicious environment variable before program execution. Successful exploitation requires the presence of the Janino library and the Spring Framework on the user's class path, as well as write access to a configuration file or the ability to inject a malicious environment variable. The issue involves the
QOS.CH component.Recommendations
Update logback-core to a version later than 1.5.18.
Fix
DoS
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Confluence
Janino
Spring Framework
Logback-Core