CVE-2024-12801: qos.ch sarl logback Server-Side Request Forgery (SSRF)

CVSS: 2.4v4.0LowDeferred

AliasesUBUNTU-CVE-2024-12801DEBIAN-CVE-2024-12801CGA-227h-335p-47xm+244 more

Published 19-12-2024Last modified 03-01-2025

Vulnerability summary

CVE-2024-12801 is a low (CVSS 2.4) Server-Side Request Forgery (SSRF) vulnerability in qos.ch sarl logback. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.4% of scored vulnerabilities.

Overall risk

10/100

0100

Low · default modelHow is this calculated?

CVSS score

2.4/10

010

Low · v4.0 (CVE.org)

EPSS score

0.23%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 13

OPENSUSE-SU-2025:14627-1 SUSE-SU-2025:0072-1 CGA-2C95-VJ5F-Q7G6 CGA-3F3W-63HG-G69H CGA-58XQ-65CR-2VMR CGA-734C-7JRF-PJ3J+7 more

Timeline

19-12-2024
PublishedVulnerability first disclosed.
03-01-2025
Last modifiedVulnerability information updated.

Description

Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML. The attacks involves the modification of DOCTYPE declaration in XML configuration files.

CVSS metrics

7 scores · 7 sources · 1 version

v4.02.4

EPSS trend

Probability

0.23%

Chance of exploitation in the next 30 days

Percentile

12%

Versus all other CVEs

30-day change

0.00 pp

From 0.22% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.23%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected systems

Chainguard122 products

akhq< 0.25.1-r2
apache-nifi< 2.1.0-r0
apache-nifi-compat< 2.1.0-r0
apache-nifi-toolkit< 2.1.0-r0
cassandra-4.0All versions (No fix recorded)

cassandra-4.1All versions (No fix recorded)
cassandra-5.0< 5.0.7-r0
cassandra-fips-4.0All versions (No fix recorded)
cassandra-fips-4.1All versions (No fix recorded)
cassandra-fips-5.0< 5.0.8-r0
cassandra-reaper< 3.7.1-r0
dependency-track-bundled< 4.13.5-r0
eco-java-gradle-1.11All versions (No fix recorded)
eco-java-gradle-2.0All versions (No fix recorded)
eco-java-gradle-2.1All versions (No fix recorded)
eco-java-gradle-2.10All versions (No fix recorded)
eco-java-gradle-2.11All versions (No fix recorded)
eco-java-gradle-2.12All versions (No fix recorded)
eco-java-gradle-2.13All versions (No fix recorded)
eco-java-gradle-2.14All versions (No fix recorded)
eco-java-gradle-2.14.1All versions (No fix recorded)
eco-java-gradle-2.2All versions (No fix recorded)
eco-java-gradle-2.2.1All versions (No fix recorded)
eco-java-gradle-2.3All versions (No fix recorded)
eco-java-gradle-2.4All versions (No fix recorded)
eco-java-gradle-2.5All versions (No fix recorded)
eco-java-gradle-2.6All versions (No fix recorded)
eco-java-gradle-2.7All versions (No fix recorded)
eco-java-gradle-2.8All versions (No fix recorded)
eco-java-gradle-2.9All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r13
kayenta-2025.4All versions (No fix recorded)
kayenta-2026.0All versions (No fix recorded)
kayenta-2026.1All versions (No fix recorded)
kayenta-fips-2025.4All versions (No fix recorded)
kayenta-fips-2026.0All versions (No fix recorded)
kayenta-fips-2026.1All versions (No fix recorded)
kserve-modelmesh< 0.12.0-r13
kserve-modelmesh-compat< 0.12.0-r13
management-api-for-apache-cassandra-4.0< 0.1.96-r1
management-api-for-apache-cassandra-4.0-compat< 0.1.96-r1
management-api-for-apache-cassandra-4.1< 0.1.96-r1
management-api-for-apache-cassandra-4.1-compat< 0.1.96-r1
management-api-for-apache-cassandra-5.0< 0.1.96-r1
management-api-for-apache-cassandra-5.0-compat< 0.1.96-r1
ontop< 5.5.0-r17
ontop-fips< 5.5.0-r10
seata-serverAll versions (No fix recorded)
sonar-scanner-cli< 6.2.1.4610-r1
sonar-scanner-cli-compat< 6.2.1.4610-r1
sonarqube< 25.6.0.109173-r0
sonarqube-10< 25.1.0.102122-r0
sonarqube-docker-compat< 25.6.0.109173-r0
sonarqube-scripts< 25.6.0.109173-r0
tez< 0.10.4-r6
thingsboard< 3.9-r0
thingsboard-tb-js-executor< 3.9-r0
thingsboard-tb-mqtt-transport< 3.9-r0
thingsboard-tb-node< 3.9-r0
thingsboard-tb-web-ui< 3.9-r0
trino< 468-r1
trino-config< 468-r1
trino-oci-entrypoint< 468-r1
trino-plugin-ai-functions< 468-r1
trino-plugin-bigquery< 468-r1
trino-plugin-blackhole< 468-r1
trino-plugin-cassandra< 468-r1
trino-plugin-clickhouse< 468-r1
trino-plugin-delta-lake< 468-r1
trino-plugin-druid< 468-r1
trino-plugin-duckdb< 468-r1
trino-plugin-elasticsearch< 468-r1
trino-plugin-exasol< 468-r1
trino-plugin-exchange-filesystem< 468-r1
trino-plugin-exchange-hdfs< 468-r1
trino-plugin-faker< 468-r1
trino-plugin-functions-python< 468-r1
trino-plugin-geospatial< 468-r1
trino-plugin-google-sheets< 468-r1
trino-plugin-hive< 468-r1
trino-plugin-http-event-listener< 468-r1
trino-plugin-http-server-event-listener< 468-r1
trino-plugin-hudi< 468-r1
trino-plugin-iceberg< 468-r1
trino-plugin-ignite< 468-r1
trino-plugin-jmx< 468-r1
trino-plugin-kafka< 468-r1
trino-plugin-kafka-event-listener< 468-r1
trino-plugin-lakehouse< 468-r1
trino-plugin-ldap-group-provider< 468-r1
trino-plugin-loki< 468-r1
trino-plugin-mariadb< 468-r1
trino-plugin-memory< 468-r1
trino-plugin-ml< 468-r1
trino-plugin-mongodb< 468-r1
trino-plugin-mysql< 468-r1
trino-plugin-mysql-event-listener< 468-r1
trino-plugin-opa< 468-r1
trino-plugin-openlineage< 468-r1
trino-plugin-opensearch< 468-r1
trino-plugin-oracle< 468-r1
trino-plugin-password-authenticators< 468-r1
trino-plugin-pinot< 468-r1
trino-plugin-postgresql< 468-r1
trino-plugin-prometheus< 468-r1
trino-plugin-ranger< 468-r1
trino-plugin-redis< 468-r1
trino-plugin-redshift< 468-r1
trino-plugin-resource-group-managers< 468-r1
trino-plugin-session-property-managers< 468-r1
trino-plugin-singlestore< 468-r1
trino-plugin-snowflake< 468-r1
trino-plugin-spooling-filesystem< 468-r1
trino-plugin-sqlserver< 468-r1
trino-plugin-teradata-functions< 468-r1
trino-plugin-thrift< 468-r1
trino-plugin-tpcds< 468-r1
trino-plugin-tpch< 468-r1
trino-plugin-vertica< 468-r1
zookeeper-fips-3.8< 3.8.4-r1
zookeeper-fips-3.8-compat< 3.8.4-r0

Show all 122

Wolfi78 products

akhq< 0.25.1-r2
apache-nifi< 2.1.0-r0
apache-nifi-compat< 2.1.0-r0
apache-nifi-toolkit< 2.1.0-r0
cassandra-4.1All versions (No fix recorded)

cassandra-5.0< 5.0.7-r0
cassandra-reaper< 3.7.1-r0
dependency-track-bundled< 4.13.5-r0
kserve-modelmesh< 0.12.0-r13
kserve-modelmesh-compat< 0.12.0-r13
management-api-for-apache-cassandra-5.0< 0.1.96-r1
management-api-for-apache-cassandra-5.0-compat< 0.1.96-r1
sonar-scanner-cli< 6.2.1.4610-r1
sonar-scanner-cli-compat< 6.2.1.4610-r1
sonarqube< 25.6.0.109173-r0
sonarqube-10< 25.1.0.102122-r0
sonarqube-docker-compat< 25.6.0.109173-r0
sonarqube-scripts< 25.6.0.109173-r0
tez< 0.10.4-r6
thingsboard< 3.9-r0
thingsboard-tb-js-executor< 3.9-r0
thingsboard-tb-mqtt-transport< 3.9-r0
thingsboard-tb-node< 3.9-r0
thingsboard-tb-web-ui< 3.9-r0
trino< 468-r1
trino-config< 468-r1
trino-oci-entrypoint< 468-r1
trino-plugin-ai-functions< 468-r1
trino-plugin-bigquery< 468-r1
trino-plugin-blackhole< 468-r1
trino-plugin-cassandra< 468-r1
trino-plugin-clickhouse< 468-r1
trino-plugin-delta-lake< 468-r1
trino-plugin-druid< 468-r1
trino-plugin-duckdb< 468-r1
trino-plugin-elasticsearch< 468-r1
trino-plugin-exasol< 468-r1
trino-plugin-exchange-filesystem< 468-r1
trino-plugin-exchange-hdfs< 468-r1
trino-plugin-faker< 468-r1
trino-plugin-functions-python< 468-r1
trino-plugin-geospatial< 468-r1
trino-plugin-google-sheets< 468-r1
trino-plugin-hive< 468-r1
trino-plugin-http-event-listener< 468-r1
trino-plugin-http-server-event-listener< 468-r1
trino-plugin-hudi< 468-r1
trino-plugin-iceberg< 468-r1
trino-plugin-ignite< 468-r1
trino-plugin-jmx< 468-r1
trino-plugin-kafka< 468-r1
trino-plugin-kafka-event-listener< 468-r1
trino-plugin-lakehouse< 468-r1
trino-plugin-ldap-group-provider< 468-r1
trino-plugin-loki< 468-r1
trino-plugin-mariadb< 468-r1
trino-plugin-memory< 468-r1
trino-plugin-ml< 468-r1
trino-plugin-mongodb< 468-r1
trino-plugin-mysql< 468-r1
trino-plugin-mysql-event-listener< 468-r1
trino-plugin-opa< 468-r1
trino-plugin-openlineage< 468-r1
trino-plugin-opensearch< 468-r1
trino-plugin-oracle< 468-r1
trino-plugin-password-authenticators< 468-r1
trino-plugin-pinot< 468-r1
trino-plugin-postgresql< 468-r1
trino-plugin-prometheus< 468-r1
trino-plugin-ranger< 468-r1
trino-plugin-redis< 468-r1
trino-plugin-redshift< 468-r1
trino-plugin-resource-group-managers< 468-r1
trino-plugin-session-property-managers< 468-r1
trino-plugin-singlestore< 468-r1
trino-plugin-snowflake< 468-r1
trino-plugin-spooling-filesystem< 468-r1
trino-plugin-sqlserver< 468-r1

Show all 78

2 vendors · 200 products · Showing 200 of 209. Use Open JSON for the complete list.

References

8 links

logback.qos.ch/news.htmlREPORTWEB
logback.qos.ch/news.htmlWEB
ubuntu.com/security/CVE-2024-12801REPORT
www.cve.org/CVERecord?id=CVE-2024-12801REPORT
security-tracker.debian.org/tracker/CVE-2024-12801Advisory
nvd.nist.gov/vuln/detail/CVE-2024-12801Advisory
github.com/qos-ch/logback/commit/5f05041cba4c4ac0a62748c5c527a2da48999f2dWEB
github.com/qos-ch/logbackPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities