CVE-2018-1285

—

CVSS 3.1

9.8 critical

EPSS

17%p97

Published

May 11, 2020 (May 11, 2020)

Modified

Jun 17, 2026

Description

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

Vendors: apache fedoraproject oracle netapp
Products: log4net, fedora, application testing suite, hospitality opera 5, hospitality simphony, manageability software development kit, snapcenter
Weakness: CWE-611
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (17.4%)

In the news0 stories

No ingested article mentions this CVE yet.