Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

CVE-2025-54812

Gravedad CVSS v4.0:
BAJA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
22/08/2025
Última modificación:
22/08/2025

Descripción

*** Pendiente de traducción *** Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.<br /> <br /> <br /> When using HTMLLayout, logger names are not properly escaped when writing out to the HTML file.<br /> If untrusted data is used to retrieve the name of a logger, an attacker could theoretically inject HTML or Javascript in order to hide information from logs or steal data from the user.<br /> In order to activate this, the following sequence must occur:<br /> <br /> <br /> <br /> * Log4cxx is configured to use HTMLLayout.<br /> <br /> * Logger name comes from an untrusted string<br /> <br /> * Logger with compromised name logs a message<br /> <br /> * User opens the generated HTML log file in their browser, leading to potential XSS<br /> <br /> <br /> Because logger names are generally constant strings, we assess the impact to users as LOW<br /> <br /> <br /> This issue affects Apache Log4cxx: before 1.5.0.<br /> <br /> <br /> Users are recommended to upgrade to version 1.5.0, which fixes the issue.