CVE-2025-54812
Gravedad CVSS v4.0:
BAJA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
22/08/2025
Última modificación:
22/08/2025
Descripción
*** Pendiente de traducción *** Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.<br />
<br />
<br />
When using HTMLLayout, logger names are not properly escaped when writing out to the HTML file.<br />
If untrusted data is used to retrieve the name of a logger, an attacker could theoretically inject HTML or Javascript in order to hide information from logs or steal data from the user.<br />
In order to activate this, the following sequence must occur:<br />
<br />
<br />
<br />
* Log4cxx is configured to use HTMLLayout.<br />
<br />
* Logger name comes from an untrusted string<br />
<br />
* Logger with compromised name logs a message<br />
<br />
* User opens the generated HTML log file in their browser, leading to potential XSS<br />
<br />
<br />
Because logger names are generally constant strings, we assess the impact to users as LOW<br />
<br />
<br />
This issue affects Apache Log4cxx: before 1.5.0.<br />
<br />
<br />
Users are recommended to upgrade to version 1.5.0, which fixes the issue.
Impacto
Puntuación base 4.0
2.10
Gravedad 4.0
BAJA