CVE-2021-42550mediumCWE-502

CVE-2021-42550: medium-severity vulnerability in QOS.ch logback

RCE from attacker with configuration edit priviledges through JNDI lookup

Published · Updated

Follow this CVE+ Monitor logback+ Monitor logback

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.6epss 4.8%
In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
QOS.ch · logback