CVE-2024-12798
highpriority · track · 0EPSS 0.005 · 39 %ileDEEUFRJPNLRUUSEPSS · scored 2026-10-22
ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension. A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 1.7–7.3
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (201)
Products and version ranges known to be affected.
- Red Hat Enterprise Linux Apache Camel for Spring Bootall versionscert_bundDEcpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot
advisories (6)
Vendor and ecosystem advisories describing this.
- NCSC-2025-0124Kwetsbaarheden verholpen in Oracle CommunicationsNL2025-04-16csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in Oracle Communications producten, waaronder de Cloud Native Core en Policy Management.
- WID-SEC-W-2025-0284Apache Camel for Spring Boot: Mehrere SchwachstellenDeutsch2025-02-05csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apache Camel, Red Hat Enterprise Linux und Red Hat Integration ausnutzen, um beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen.
- WID-SEC-W-2025-0824Oracle Communications Applications: Mehrere SchwachstellenDeutsch2025-04-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- GHSA-pr98-23f8-jwxvQOS.CH logback-core Expression Language Injection vulnerability2024-12-19ghsa · osvUS
ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core up to and including version 1.5.12 in Java applications allows attackers to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension. A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
- CERTFR-2026-AVI-1352Multiples vulnérabilités dans Oracle PeopleSoftFrançais2026-10-21vendor · certfrFR
- JVNDB-2026-010300JVN iPedia advisory JVNDB-2026-0103002026-04-08vendor · jvndbJP
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2024-12798cnnvd
- https://logback.qos.ch/news.html#1.3.15cnnvd
- https://logback.qos.ch/news.html#1.5.13cnnvd
- https://vigilance.fr/vulnerability/Logback-privilege-escalation-via-JaninoEventEvaluator-46045cnnvd
- https://www.oracle.com/security-alerts/cpuapr2025.htmlcnnvd
- https://www.oracle.com/security-alerts/cpuoct2025.htmlcnnvd
- https://logback.qos.ch/news.html#1.3.15enisa_euvd
- https://logback.qos.ch/news.html#1.5.13enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan