Tracker / CVE-2018-1285
CVE-2018-1285
Critical 9.8
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
Affected products and versions
| apache | log4net · … → 2.0.10 |
|---|---|
| fedoraproject | fedora |
| netapp | manageability_software_development_kit |
| netapp | snapcenter |
| oracle | application_testing_suite |
| oracle | hospitality_opera_5 |
| oracle | hospitality_simphony |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.