CVE-2018-1285
XML External Entity attack in log4net
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
- Record
CVE-2018-1285- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE List No score
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
- Record
CVE-2018-1285- Updated
- 2026-11-02
EUVDEUVD-2021-0478 No score
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
- Record
EUVD-2021-0478- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2cwj-8chv-9pp9
XML External Entity attack in log4net
Apache log4net before 2.0.10 does not disable XML external entities when parsing log4net configuration files. This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users.
- Record
GHSA-2cwj-8chv-9pp9- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
- Record
CVE-2018-1285- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-1285
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
- Record
DEBIAN-CVE-2018-1285- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-2cwj-8chv-9pp9
XML External Entity attack in log4net
Apache log4net before 2.0.10 does not disable XML external entities when parsing log4net configuration files. This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users.
- Record
GHSA-2cwj-8chv-9pp9- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-1285
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
- Record
UBUNTU-CVE-2018-1285- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2020-0233 No score
Updated log4net packages fix security vulnerability
Updated log4net packages fix security vulnerability This patch fixes a security vulnerability reported by Karthik Balasundaram. The security vulnerability was found in the way how log4net parses xml configuration files where it allowed to process XML External Entity Processing. An attacker could use this as an attack vector if he could modify the XML configuration file.
- Record
MGASA-2020-0233- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12311-1 No score
log4net-1.2.10-78.1 on GA media
These are all security issues fixed in the log4net-1.2.10-78.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12311-1- Updated
- 2026-11-02
OSVUSN-4699-1 No score
log4net vulnerability
It was discovered that Apache Log4net incorrectly handled certain configuration files. An attacker could possibly use this issue to expose sensitive information.
- Record
USN-4699-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
log4netNuGet |
before 2.0.10 | 2.0.10 |
log4netDebian:13 |
before 1.2.10+dfsg-8 | 1.2.10+dfsg-8 |
log4netDebian:14 |
before 1.2.10+dfsg-8 | 1.2.10+dfsg-8 |
log4netDebian:8 |
before 1.2.10+dfsg-6+deb8u1, plus listed versions 1.2.10+dfsg-6 |
1.2.10+dfsg-6+deb8u1 |
log4netNuGet |
before 2.0.10, plus listed versions 1.2.101.2.112.0.02.0.12.0.2 Show 7 moreShow less2.0.32.0.42.0.52.0.62.0.72.0.82.0.9 |
2.0.10 |
log4netMageia:7 |
before 2.0.8-2.1.mga7 | 2.0.8-2.1.mga7 |
log4netUbuntu:16.04:LTS |
before 1.2.10+dfsg-7ubuntu0.16.04.1, plus listed versions 1.2.10+dfsg-61.2.10+dfsg-7 |
1.2.10+dfsg-7ubuntu0.16.04.1 |
log4netUbuntu:18.04:LTS |
before 1.2.10+dfsg-7ubuntu0.18.04.1, plus listed versions 1.2.10+dfsg-7 |
1.2.10+dfsg-7ubuntu0.18.04.1 |
log4netUbuntu:20.04:LTS |
before 1.2.10+dfsg-7ubuntu0.20.04.1, plus listed versions 1.2.10+dfsg-7 |
1.2.10+dfsg-7ubuntu0.20.04.1 |
log4netopenSUSE:Tumbleweed |
before 1.2.10-78.1 | 1.2.10-78.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | alex-ermolaev/Log4NetSolarWindsSNMP- | 2021-12-31 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1285 is a critical vulnerability (CVSS 9.8) in Apache Log4net, published May 11, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 17.8%, the 97th percentile. Fixed in log4net 2.0.10.
References
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2U233HVAQDSZ2PRG4XSGDASLY3J6ALH
lists.apache.org/thread.html/r33564de316d4e4ba0fea1d4d079e62cde1ffe64369c1157243d840d9%40%3Cdev.logging.apache.org%3E
Show 37 moreShow less
oracle.com/security-alerts/cpujan2021.html
issues.apache.org/jira/browse/LOG4NET-575
security.netapp.com/advisory/ntap-20220909-0001
nvd.nist.gov/vuln/detail/CVE-2018-1285
snyk.io/vuln/SNYK-DOTNET-LOG4NET-568897
nuget.org/packages/log4net
whitesourcesoftware.com/vulnerability-database/CVE-2018-1285
github.com/advisories/GHSA-2cwj-8chv-9pp9
security-tracker.debian.org/tracker/CVE-2018-1285
advisories.mageia.org/MGASA-2020-0233.html
bugs.mageia.org/show_bug.cgi?id=26608
debian.org/lts/security/2020/dla-2211
ubuntu.com/security/CVE-2018-1285
cve.org/CVERecord?id=CVE-2018-1285
suse.com/security/cve/CVE-2018-1285