CVE-2025-54813mediumCWE-117

CVE-2025-54813: falha de média gravidade em Apache Log4cxx

Apache Log4cxx: Improper escaping with JSONLayout

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache Log4cxx+ Monitorar log4cxx

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 1.4%
Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them. This issue affects Apache Log4cxx: before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Produtos afetados
Apache Software Foundation · Apache Log4cxx
CVEs relacionadas — Apache Log4cxx

No mesmo produto, das mais perigosas para as menos.

CVE-2023-31038HIGHApache Log4cxx: SQL injection when using ODBC appenderEPSS 1.6%CVE-2025-54812LOWApache Log4cxx: Improper HTML escaping in HTMLLayoutEPSS 1.2%CVE-2026-40023MEDIUMApache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden charactersEPSS 0.5%