Red Hat JBossEAP: Server-Side Request Forgery (SSRF) (CVE-2024-12801)

Red Hat JBossEAP: Server-Side Request Forgery (SSRF) (CVE-2024-12801)

Severity

2

CVSS

(AV:L/AC:H/Au:S/C:P/I:P/A:N)

Published

12/19/2024

Created

01/08/2025

Added

01/07/2025

Modified

02/03/2025

Description

Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12  on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML. The attacks involves the modification of DOCTYPE declaration in  XML configuration files.. A Server-Side Request Forgery (SSRF) vulnerability was found in Logback. This flaw allows a local attacker to forge requests by modifying XML configuration files to ignore external DTD files specified in DOCTYPE declarations, potentially exposing confidential or restricted data.

Solution(s)

• red-hat-jboss-eap-upgrade-latest

References

• https://attackerkb.com/topics/cve-2024-12801
• CVE - 2024-12801
• https://access.redhat.com/security/cve/CVE-2024-12801
• https://bugzilla.redhat.com/show_bug.cgi?id=2333370
• https://logback.qos.ch/news.html#1.5.13