You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Path to dependency file: /hapi-fhir-spring-boot/hapi-fhir-spring-boot-samples/hapi-fhir-spring-boot-sample-server-jersey/pom.xml
Path to vulnerable library: /hapi-fhir-spring-boot/hapi-fhir-spring-boot-samples/hapi-fhir-spring-boot-sample-server-jersey/pom.xml,/hapi-fhir-base/pom.xml,/hapi-fhir-storage-batch2-test-utilities/pom.xml,/hapi-fhir-spring-boot/hapi-fhir-spring-boot-starter/pom.xml,/tests/hapi-fhir-base-test-jaxrsserver-kotlin/pom.xml,/hapi-fhir-jpaserver-test-utilities/pom.xml,/hapi-fhir-storage-test-utilities/pom.xml,/hapi-fhir-jpaserver-elastic-test-utilities/pom.xml,/hapi-fhir-spring-boot/hapi-fhir-spring-boot-samples/hapi-fhir-spring-boot-sample-client-okhttp/pom.xml,/hapi-fhir-checkstyle/pom.xml,/hapi-tinder-plugin/pom.xml,/hapi-fhir-test-utilities/pom.xml,/hapi-fhir-jpaserver-uhnfhirtest/pom.xml,/hapi-fhir-cli/hapi-fhir-cli-app/pom.xml,/hapi-fhir-spring-boot/hapi-fhir-spring-boot-samples/hapi-fhir-spring-boot-sample-client-apache/pom.xml,/hapi-fhir-docs/pom.xml
Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 1.5.12 on the Java platform, allows an attacker to
forge requests by compromising logback configuration files in XML.
The attacks involves the modification of DOCTYPE declaration in XML configuration files.
CVE-2024-12801 - Medium Severity Vulnerability
Vulnerable Library - logback-core-1.5.12.jar
logback-core module
Library home page: http://logback.qos.ch
Path to dependency file: /hapi-fhir-spring-boot/hapi-fhir-spring-boot-samples/hapi-fhir-spring-boot-sample-server-jersey/pom.xml
Path to vulnerable library: /hapi-fhir-spring-boot/hapi-fhir-spring-boot-samples/hapi-fhir-spring-boot-sample-server-jersey/pom.xml,/hapi-fhir-base/pom.xml,/hapi-fhir-storage-batch2-test-utilities/pom.xml,/hapi-fhir-spring-boot/hapi-fhir-spring-boot-starter/pom.xml,/tests/hapi-fhir-base-test-jaxrsserver-kotlin/pom.xml,/hapi-fhir-jpaserver-test-utilities/pom.xml,/hapi-fhir-storage-test-utilities/pom.xml,/hapi-fhir-jpaserver-elastic-test-utilities/pom.xml,/hapi-fhir-spring-boot/hapi-fhir-spring-boot-samples/hapi-fhir-spring-boot-sample-client-okhttp/pom.xml,/hapi-fhir-checkstyle/pom.xml,/hapi-tinder-plugin/pom.xml,/hapi-fhir-test-utilities/pom.xml,/hapi-fhir-jpaserver-uhnfhirtest/pom.xml,/hapi-fhir-cli/hapi-fhir-cli-app/pom.xml,/hapi-fhir-spring-boot/hapi-fhir-spring-boot-samples/hapi-fhir-spring-boot-sample-client-apache/pom.xml,/hapi-fhir-docs/pom.xml
Dependency Hierarchy:
Found in HEAD commit: 4d4d8b25d41ea632109b5a3585587d2bf861b5d6
Found in base branch: master
Vulnerability Details
Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 1.5.12 on the Java platform, allows an attacker to
forge requests by compromising logback configuration files in XML.
The attacks involves the modification of DOCTYPE declaration in XML configuration files.
Publish Date: 2024-12-19
URL: CVE-2024-12801
CVSS 3 Score Details (5.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-6v67-2wr5-gvf4
Release Date: 2024-12-19
Fix Resolution: ch.qos.logback:logback-core:1.5.13
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: