XML External Entity injection in Logback - CVE-2024-12801

Vulnerability identifier: #VU103290

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2024-12801

CWE-ID: CWE-611

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input in SaxEventRecorder. A remote attacker can pass a specially crafted configuration XML file to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.

Logback
Netcool Operations Insight
PowerVC
IBM Rational ClearCase
Oracle Middleware Common Libraries and Tools
IBM Automation Decision Services
IBM Cloud Pak for Security
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Machine Learning on CP4D
IBM Cloud Pak for Business Automation
Operations Analytics - Log Analysis
Cloud Pak for Network Automation
Tivoli Network Manager IP Edition
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
CICS Transaction Gateway for Multiplatforms
CICS Transaction Gateway Desktop Edition
DevOps Code ClearCase
IBM Application Suite - IBM Asset Data Dictionary Component
Telco Service Design Configuration Designer
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
Telco Network Function Virtualization Orchestrator
Business Automation Insights
Hybrid Cloud Observability
watsonx.data
IBM Cloud Pak System
openSUSE Leap
openEuler
Orion Platform
logback-access
logback-examples
logback-help
logback
logback-javadoc

Install updates from vendor's website.

Logback - addressed in versions 1.3.15, 1.5.13
Operations Analytics - Log Analysis - update to 1.3.8.4
Netcool Operations Insight - update to 1.6.15
watsonx.data - update to 2.2.1
PowerVC - addressed in versions 2.2.1.2, 2.3.0
IBM Cloud Pak System - update to 2.3.6.0
Cloud Pak for Network Automation - update to 2.7.8
Tivoli Network Manager IP Edition - update to 4.2.0.22
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.1.3
IBM Rational ClearCase - update to 10.0.1.6
DevOps Code ClearCase - update to 11.0.0.6
Orion Platform - update to 2025.4.1
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.15
logback-access - update to 1.2.8-4
logback-examples - update to 1.2.8-4
logback-help - update to 1.2.8-4
logback - update to 1.2.8-4
logback-examples - update to 1.2.11-150200.3.10.1
logback - update to 1.2.11-150200.3.10.1
logback-javadoc - update to 1.2.11-150200.3.10.1
logback-access - update to 1.2.11-150200.3.10.1
IBM Cloud Pak for Security - update to 1.11.2.0
Telco Service Design Configuration Designer - update to 2.3.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.9
watsonx Assistant Cartridge - update to 5.1.3
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.3
IBM Watson Machine Learning on CP4D - update to 5.3.0
Telco Network Function Virtualization Orchestrator - update to 7.3.0
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF004, 24.0.1-IF001
Business Automation Insights - addressed in versions 24.0.0.0.2, 24.0.1.0.1
Hybrid Cloud Observability - update to 2025.4.1

• https://logback.qos.ch/news.html#1.3.15
• https://logback.qos.ch/news.html#1.5.13

• Multiple vulnerabilities in Logback
• openEuler update for logback
• SUSE update for logback
• Multiple vulnerabilities in IBM Asset Data Dictionary Component
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM Cloud Pak for Security
• IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data update for SaxEventRecorder by QOS.CH logback
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge
• Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition
• Multiple vulnerabilities in HPE Telco Network Function Virtualization Orchestrator Software
• Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools
• Multiple vulnerabilities in IBM PowerVC
• Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in SolarWinds Observability
• Multiple vulnerabilities in SolarWinds Platform
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Automation Decision Services
• Multiple vulnerabilities in IBM Watson Machine Learning
• Multiple vulnerabilities in IBM DevOps Code ClearCase
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition