{"id":"CVE-2018-1285","aliases":["DEBIAN-CVE-2018-1285","DLA-2211-1","EUVD-2021-0478","GHSA-2cwj-8chv-9pp9","MGASA-2020-0233","UBUNTU-CVE-2018-1285","USN-4699-1","openSUSE-SU-2024:12311-1"],"status":"published","title":"XML External Entity attack in log4net","description":"Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.17823,"percentile":0.97188,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-611"],"published":"2020-05-11T16:41:28Z","modified":"2026-10-25T23:30:03Z","exploits":[{"source":"pocgithub","id":"alex-ermolaev/Log4NetSolarWindsSNMP-","title":"alex-ermolaev/Log4NetSolarWindsSNMP-","date":"2021-12-31","url":"https://github.com/alex-ermolaev/Log4NetSolarWindsSNMP-"}],"fixes":[{"ecosystem":"NuGet","package":"log4net","fixed_in":["2.0.10"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"log4net","fixed_in":["1.2.10+dfsg-8"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"log4net","fixed_in":["1.2.10+dfsg-8"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"log4net","fixed_in":["1.2.10+dfsg-6+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"log4net","fixed_in":["2.0.8-2.1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"log4net","fixed_in":["1.2.10+dfsg-7ubuntu0.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"log4net","fixed_in":["1.2.10+dfsg-7ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"log4net","fixed_in":["1.2.10+dfsg-7ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"log4net","fixed_in":["1.2.10-78.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"log4net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"log4net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10+dfsg-8"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"log4net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10+dfsg-8"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"log4net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10+dfsg-6+deb8u1"}]}],"versions":["1.2.10+dfsg-6"]},{"source":"osv","ecosystem":"NuGet","package":"log4net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10"}]}],"versions":["1.2.10","1.2.11","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9"]},{"source":"osv","ecosystem":"Mageia:7","package":"log4net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-2.1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"log4net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10+dfsg-7ubuntu0.16.04.1"}]}],"versions":["1.2.10+dfsg-6","1.2.10+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"log4net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10+dfsg-7ubuntu0.18.04.1"}]}],"versions":["1.2.10+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"log4net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10+dfsg-7ubuntu0.20.04.1"}]}],"versions":["1.2.10+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"log4net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10+dfsg-7ubuntu0.16.04.1"}]}],"versions":["1.2.10+dfsg-6","1.2.10+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"log4net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10+dfsg-7ubuntu0.18.04.1"}]}],"versions":["1.2.10+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"log4net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10+dfsg-7ubuntu0.20.04.1"}]}],"versions":["1.2.10+dfsg-7"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"log4net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10-78.1"}]}]}],"products":[{"vendor":"apache","product":"log4net"},{"vendor":"apache software foundation","product":"apache log4net"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"netapp","product":"manageability_software_development_kit"},{"vendor":"netapp","product":"snapcenter"},{"vendor":"oracle","product":"application_testing_suite"},{"vendor":"oracle","product":"hospitality_opera_5"},{"vendor":"oracle","product":"hospitality_simphony"}],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2U233HVAQDSZ2PRG4XSGDASLY3J6ALH/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKL2LPINAI6BCMXOH4V4HVHGLUXIWOFO/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT2DNNSW7C7FNK3MA3SLEUHGW5USYZKE/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r33564de316d4e4ba0fea1d4d079e62cde1ffe64369c1157243d840d9%40%3Cdev.logging.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9de86a185575e6c5f92e2a70a1d2e2e9514dc4341251577aac8e3866%40%3Cdev.logging.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r6543acafca3e2d24ff4b0c364a91540cb9378977ffa8d37a03ab4b0f%40%3Cdev.logging.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r7ab6b6e702f11a6f77b0db2af2d5e5532f56ae4b99b5fe73c5200b6a%40%3Cdev.logging.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rdbac24c945ca5c69cd5348b5ac023bc625768f653335de146e09ae2d%40%3Cdev.logging.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd2d72a017e238d1f345f9d14e075c81be16fc68a41c9e9ad9e29a732%40%3Cdev.logging.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r00b16ac5e0bbf7009a0d167ed58f3f94d0033b0f4b3e3d5025cc4872%40%3Cdev.logging.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/reab1c277c95310bad1038255e0757857b2fbe291411b4fa84552028a%40%3Cdev.logging.apache.org%3E","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory","web","report"]},{"url":"https://issues.apache.org/jira/browse/LOG4NET-575","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r525cbbd7db0aef4a114cf60de8439aa285decc34904d42a7f14f39c3%40%3Cdev.logging.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20220909-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1285","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r00b16ac5e0bbf7009a0d167ed58f3f94d0033b0f4b3e3d5025cc4872@%3Cdev.logging.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r33564de316d4e4ba0fea1d4d079e62cde1ffe64369c1157243d840d9@%3Cdev.logging.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r6543acafca3e2d24ff4b0c364a91540cb9378977ffa8d37a03ab4b0f@%3Cdev.logging.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r7ab6b6e702f11a6f77b0db2af2d5e5532f56ae4b99b5fe73c5200b6a@%3Cdev.logging.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r9de86a185575e6c5f92e2a70a1d2e2e9514dc4341251577aac8e3866@%3Cdev.logging.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rd2d72a017e238d1f345f9d14e075c81be16fc68a41c9e9ad9e29a732@%3Cdev.logging.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rdbac24c945ca5c69cd5348b5ac023bc625768f653335de146e09ae2d@%3Cdev.logging.apache.org%3E","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2U233HVAQDSZ2PRG4XSGDASLY3J6ALH/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKL2LPINAI6BCMXOH4V4HVHGLUXIWOFO/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VT2DNNSW7C7FNK3MA3SLEUHGW5USYZKE/"},{"url":"https://snyk.io/vuln/SNYK-DOTNET-LOG4NET-568897","tags":["web"]},{"url":"https://www.nuget.org/packages/log4net/"},{"url":"https://www.whitesourcesoftware.com/vulnerability-database/CVE-2018-1285","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r525cbbd7db0aef4a114cf60de8439aa285decc34904d42a7f14f39c3@%3Cdev.logging.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2cwj-8chv-9pp9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1285","tags":["advisory"]},{"url":"https://www.nuget.org/packages/log4net","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20220909-0001","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VT2DNNSW7C7FNK3MA3SLEUHGW5USYZKE","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKL2LPINAI6BCMXOH4V4HVHGLUXIWOFO","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2U233HVAQDSZ2PRG4XSGDASLY3J6ALH","tags":["web"]},{"url":"https://github.com/apache/logging-log4net","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2020-0233.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26608","tags":["report"]},{"url":"https://www.debian.org/lts/security/2020/dla-2211","tags":["web"]},{"url":"https://github.com/apache/logging-log4net/commit/d0b4b0157d4af36b23c24a23739c47925c3bd8d7","tags":["web","report"]},{"url":"https://ubuntu.com/security/CVE-2018-1285","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4699-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1285","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1285","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-1285","description":"Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.","status":"published","published":"2020-05-11T16:41:28Z","modified":"2024-08-05T03:59:37.654Z","updated_at":"2026-11-02T14:35:08.701206Z"}],"euvd":[{"id":"EUVD-2021-0478","description":"Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.","status":"published","published":"2020-05-11T16:41:28Z","modified":"2024-08-05T03:59:37Z","updated_at":"2026-11-03T02:40:16.309405Z"}],"ghsa":[{"id":"GHSA-2cwj-8chv-9pp9","title":"XML External Entity attack in log4net","description":"Apache log4net before 2.0.10 does not disable XML external entities when parsing log4net configuration files. This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users.","status":"published","published":"2021-01-29T19:47:23Z","modified":"2023-01-30T05:02:18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:36:27.500048Z"}],"nvd":[{"id":"CVE-2018-1285","description":"Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.","status":"published","published":"2020-05-11T17:15:10.923Z","modified":"2026-06-17T01:50:55.247Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:05:00.03074Z"}],"osv":[{"id":"CVE-2018-1285","description":"Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.","status":"published","published":"2020-05-11T17:15:10.923Z","modified":"2026-10-24T10:30:34.475000197Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"DEBIAN-CVE-2018-1285","description":"Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.","status":"published","published":"2020-05-11T17:15:10.923Z","modified":"2026-10-23T18:03:36.7128142Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"GHSA-2cwj-8chv-9pp9","title":"XML External Entity attack in log4net","description":"Apache log4net before 2.0.10 does not disable XML external entities when parsing log4net configuration files. This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users.","status":"published","published":"2021-01-29T19:47:23Z","modified":"2024-03-12T05:19:25.985779Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"UBUNTU-CVE-2018-1285","description":"Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.","status":"published","published":"2020-05-11T17:15:00Z","modified":"2026-10-25T23:30:03.011257164Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"DLA-2211-1","title":"log4net - security update","status":"published","published":"2020-05-15T00:00:00Z","modified":"2026-03-09T01:21:50.408261Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2020-0233","title":"Updated log4net packages fix security vulnerability","description":"Updated log4net packages fix security vulnerability\nThis patch fixes a security vulnerability reported by Karthik\nBalasundaram. The security vulnerability was found in the way\nhow log4net parses xml configuration files where it allowed to\nprocess XML External Entity Processing. An attacker could use \nthis as an attack vector if he could modify the XML configuration file.\n","status":"published","published":"2020-05-27T09:52:46Z","modified":"2026-05-16T06:30:15.662303Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2024:12311-1","title":"log4net-1.2.10-78.1 on GA media","description":"These are all security issues fixed in the log4net-1.2.10-78.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:13:29.175308Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"USN-4699-1","title":"log4net vulnerability","description":"It was discovered that Apache Log4net incorrectly handled certain configuration files.\nAn attacker could possibly use this issue to expose sensitive information.\n","status":"published","published":"2021-01-19T12:50:54Z","modified":"2026-04-27T15:48:19.226529Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}