{"id":"GHSA-6v67-2wr5-gvf4","summary":"QOS.CH logback-core Server-Side Request Forgery vulnerability","details":"Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML.\n \nThe attacks involves the modification of DOCTYPE declaration in  XML configuration files.","aliases":["CVE-2024-12801"],"modified":"2026-07-17T21:14:52.854853094Z","published":"2024-12-19T18:31:37Z","database_specific":{"cwe_ids":["CWE-918"],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2024-12-19T22:22:44Z","nvd_published_at":"2024-12-19T17:15:08Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12801"},{"type":"WEB","url":"https://github.com/qos-ch/logback/commit/5f05041cba4c4ac0a62748c5c527a2da48999f2d"},{"type":"PACKAGE","url":"https://github.com/qos-ch/logback"},{"type":"WEB","url":"https://logback.qos.ch/news.html#1.3.15"},{"type":"WEB","url":"https://logback.qos.ch/news.html#1.5.13"}],"affected":[{"package":{"name":"ch.qos.logback:logback-core","ecosystem":"Maven","purl":"pkg:maven/ch.qos.logback/logback-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.5.13"}]}],"versions":["1.4.0","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5.0","1.5.1","1.5.10","1.5.11","1.5.12","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-6v67-2wr5-gvf4/GHSA-6v67-2wr5-gvf4.json"}},{"package":{"name":"ch.qos.logback:logback-core","ecosystem":"Maven","purl":"pkg:maven/ch.qos.logback/logback-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.15"}]}],"versions":["0.2.5","0.3","0.5","0.6","0.7","0.7.1","0.8","0.8.1","0.9","0.9.1","0.9.10","0.9.11","0.9.12","0.9.13","0.9.14","0.9.15","0.9.16","0.9.17","0.9.18","0.9.19","0.9.2","0.9.20","0.9.21","0.9.22","0.9.23","0.9.24","0.9.25","0.9.26","0.9.27","0.9.28","0.9.29","0.9.3","0.9.30","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.1.1","1.1.10","1.1.11","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.2.0","1.2.1","1.2.10","1.2.11","1.2.12","1.2.13","1.2.2","1.2.3","1.2.4","1.2.4-groovyless","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.0-alpha0","1.3.0-alpha1","1.3.0-alpha10","1.3.0-alpha11","1.3.0-alpha12","1.3.0-alpha13","1.3.0-alpha14","1.3.0-alpha15","1.3.0-alpha16","1.3.0-alpha2","1.3.0-alpha3","1.3.0-alpha4","1.3.0-alpha5","1.3.0-alpha6","1.3.0-alpha7","1.3.0-alpha8","1.3.0-alpha9","1.3.0-beta0","1.3.1","1.3.10","1.3.11","1.3.12","1.3.13","1.3.14","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-6v67-2wr5-gvf4/GHSA-6v67-2wr5-gvf4.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/V:D/U:Clear"}]}