Vulnerabilities

CVSS

9.8 Critical

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk score

78.4

Published

2020-05-11

Status

Modified

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

Weaknesses

CWE-611

Coverage 1

vulnerability

Applied Systems Engineering ASE2000 V2 Communications Test Set

Applied Systems Engineering’s ASE2000 V2 Communications Test Set versions 2.25 through 2.37 are vulnerable to two separate attacks. The first stems from an improper XML External Entity Reference (CWE-611) due to a Log4Ne…

CISA Advisories · 3d ago High

CVE-2018-1285CVE-2026-18717log4netxml external entitycertificate validation

All articles mentioning it

Advisories and references

• issues.apache.org/jira/browse/LOG4NET-575
• lists.apache.org/thread.html/r00b16ac5e0bbf7009a0d167ed58f3f94d0033b...
• lists.apache.org/thread.html/r33564de316d4e4ba0fea1d4d079e62cde1ffe6...
• lists.apache.org/thread.html/r525cbbd7db0aef4a114cf60de8439aa285decc...
• lists.apache.org/thread.html/r6543acafca3e2d24ff4b0c364a91540cb93789...
• lists.apache.org/thread.html/r7ab6b6e702f11a6f77b0db2af2d5e5532f56ae...
• lists.apache.org/thread.html/r9de86a185575e6c5f92e2a70a1d2e2e9514dc4...
• lists.apache.org/thread.html/rd2d72a017e238d1f345f9d14e075c81be16fc6...
• lists.apache.org/thread.html/rdbac24c945ca5c69cd5348b5ac023bc625768f...
• lists.apache.org/thread.html/reab1c277c95310bad1038255e0757857b2fbe2...