VDE-2024-004

csafDEtrumpf_psirt

TRUMPF: Multiple products affected by log4net vulnerability

Advisory ansehen veröffentlicht 2025-04-22

The versions of TRUMPF products stated below are including a version of log4net that's prone to XXE (External XML Entities) attacks under certain circumstances. This means, the log4net code can be tricked into loading externally hosted, potentially malicious XML code and possibly executing it. This vulnerability allows for the execution of remote XML code, possibly resulting in unauthorized (remote) access to, change of data or disruption of the whole system running the vulnerable application.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2018-1285UScritical9.8Exploit
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept a…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (6)

  • BehobenOseon (Storage)

    New versions are available for the affected products. Install new versions as provided by TRUMPF SE + Co. KG. To aquire these versions please contact your TRUMPF Service with the PR number 500879.

  • BehobenTruTops Boost

    New versions are available for the affected products. Install new versions as provided by TRUMPF SE + Co. KG. To aquire these versions please contact your TRUMPF Service with the PR number 500879.

  • BehobenTruTops Cell

    New versions are available for the affected products. Install new versions as provided by TRUMPF SE + Co. KG. To aquire these versions please contact your TRUMPF Service with the PR number 500879.

  • BehobenTruTops Classic

    New versions are available for the affected products. Install new versions as provided by TRUMPF SE + Co. KG. To aquire these versions please contact your TRUMPF Service with the PR number 500879.

  • BehobenTruTops Fab (Storage)

    New versions are available for the affected products. Install new versions as provided by TRUMPF SE + Co. KG. To aquire these versions please contact your TRUMPF Service with the PR number 500879.

  • BehobenTruTops Mark

    New versions are available for the affected products. Install new versions as provided by TRUMPF SE + Co. KG. To aquire these versions please contact your TRUMPF Service with the PR number 500879.

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan