Vulnerability Name:

CVE-2018-1285 (CCN-181739)

Assigned:2017-12-07
Published:2020-05-10
Updated:2022-10-27
Summary:Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
CVSS v3 Severity:9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.6 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
6.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-611
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2018-1285

Source: XF
Type: UNKNOWN
apache-cve20181285-sec-bypass(181739)

Source: MISC
Type: Issue Tracking, Vendor Advisory
https://issues.apache.org/jira/browse/LOG4NET-575

Source: MLIST
Type: Mailing List, Vendor Advisory
[logging-dev] 20200906 [VOTE] [log4net] Release 2.0.10

Source: MLIST
Type: Mailing List, Vendor Advisory
[logging-dev] 20200525 [CVE-2018-1285] XXE vulnerability in Apache log4net

Source: MLIST
Type: Mailing List, Vendor Advisory
[logging-dev] 20210817 Solution for vulnerability

Source: MLIST
Type: Mailing List, Vendor Advisory
[logging-dev] 20200617 Re: [CVE-2018-1285] XXE vulnerability in Apache log4net

Source: MLIST
Type: Mailing List, Vendor Advisory
[logging-dev] 20200730 Re: [CVE-2018-1285] XXE vulnerability in Apache log4net

Source: MLIST
Type: Mailing List, Vendor Advisory
[logging-dev] 20200525 Re: [CVE-2018-1285] XXE vulnerability in Apache log4net

Source: MLIST
Type: Mailing List, Vendor Advisory
[logging-dev] 20200826 Re: log4net.dll - does 2.0.9 fix CVE-2018-1285

Source: MLIST
Type: Mailing List, Vendor Advisory
[logging-dev] 20200826 log4net.dll - does 2.0.9 fix CVE-2018-1285

Source: MISC
Type: Mailing List, Vendor Advisory
https://lists.apache.org/thread.html/reab1c277c95310bad1038255e0757857b2fbe291411b4fa84552028a%40%3Cdev.logging.apache.org%3E

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-cfc319e067

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-73d380e9b9

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-847775bf79

Source: CCN
Type: Apache log4net Web site
Apache log4net

Source: CCN
Type: oss-sec Mailing List, Sun, 10 May 2020 13:21:33 -0500
[CVE-2018-1285] XXE vulnerability in Apache log4net

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20220909-0001/

Source: CCN
Type: Oracle Critical Patch Update Advisory - April 2021
Oracle Critical Patch Update Advisory - April 2021

Source: MISC
Type: Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html

Source: CCN
Type: Oracle CPUApr2022
Oracle Critical Patch Update Advisory - April 2022

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html

Source: CCN
Type: Oracle CPUJan2021
Oracle Critical Patch Update Advisory - January 2021

Source: MISC
Type: Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html

Vulnerable Configuration:Configuration 1:
  • cpe:/a:apache:log4net:*:*:*:*:*:*:*:* (Version < 2.0.10)

    • Configuration 2:
  • cpe:/o:fedoraproject:fedora:30:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:31:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:32:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:hospitality_simphony:19.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:hospitality_simphony:18.2.7.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:hospitality_opera_5:5.5:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:hospitality_opera_5:5.6:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/a:netapp:snapcenter:-:*:*:*:*:*:*:*
  • OR cpe:/a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:apache:log4net:2.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:apache:log4net:2.0.8:*:*:*:*:*:*:*
  • AND
  • cpe:/a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    apache log4net *
    fedoraproject fedora 30
    fedoraproject fedora 31
    fedoraproject fedora 32
    oracle application testing suite 13.3.0.1
    oracle hospitality simphony 19.1.3
    oracle hospitality simphony 18.2.7.2
    oracle hospitality opera 5 5.5
    oracle hospitality opera 5 5.6
    netapp snapcenter -
    netapp manageability software development kit -
    apache log4net 2.0.7
    apache log4net 2.0.8
    oracle application testing suite 13.3.0.1