CVE-2025-11226 (CNNVD-202510-244)
中文标题:
Quality Open Software Logback 安全漏洞
英文标题:
Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino
漏洞描述
中文描述:
Quality Open Software Logback是瑞士Quality Open Software公司的一个 Java 应用程序的日志记录框架。 Quality Open Software Logback 1.5.18及之前版本存在安全漏洞，该漏洞源于条件配置文件处理不当，可能导致执行任意代码。
英文描述:
ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. A successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| QOS.CH Sarl | Logback-core | - | ≤ 1.5.18 | - |
cpe:2.3:a:qos.ch_sarl:logback-core:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
4.0 (cna)
MEDIUMCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/AU:N/RE:M/U:Green
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-11226 |
2025-11-11 15:23:02 | 2025-11-11 07:40:05 |
| NVD | nvd_CVE-2025-11226 |
2025-11-11 15:01:04 | 2025-11-11 07:47:56 |
| CNNVD | cnnvd_CNNVD-202510-244 |
2025-11-11 15:12:30 | 2025-11-11 08:00:18 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202510-244
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']