CVE-2024-12798
Severity CVSS v4.0:
MEDIUM
Type:
Unavailable / Other
Publication date:
19/12/2024
Last modified:
15/04/2026
Description
ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core<br />
upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows<br />
attacker to execute arbitrary code by compromising an existing<br />
logback configuration file or by injecting an environment variable<br />
before program execution.<br />
<br />
<br />
<br />
<br />
<br />
Malicious logback configuration files can allow the attacker to execute <br />
arbitrary code using the JaninoEventEvaluator extension.<br />
<br />
<br />
<br />
A successful attack requires the user to have write access to a <br />
configuration file. Alternatively, the attacker could inject a malicious <br />
environment variable pointing to a malicious configuration file. In both <br />
cases, the attack requires existing privilege.