CVE-2018-1285 XML External Entity attack in log4net
Attackers can exploit XML external entity vulnerabilities in Apache log4net configuration parsing to read sensitive data or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1285?
CVE-2018-1285 is a critical vulnerability in Fedoraproject Fedora, published on 11 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
Weakness: CWE-611
Which versions are affected by CVE-2018-1285?
2 open source packages ship an affected version, including log4net. It affects 7 products.
| Package | Affected | Fixed in |
|---|---|---|
log4net NuGet | All versions | 2.0.10 |
log4net NuGet | All versions | 2.0.10 |
Linux distribution packages (1)
log4net openSUSE:Tumbleweed | All versions | 1.2.10-78.1 |
Products include Apache Log4net, Fedoraproject Fedora, Netapp Manageability Software Development Kit, Netapp Snapcenter, Oracle Application Testing Suite, Oracle Hospitality Opera 5 and 1 more.
How do I fix CVE-2018-1285?
Upgrade log4net to 2.0.10 or later.
Is CVE-2018-1285 being exploited?
There is no known exploitation of CVE-2018-1285 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Fedoraproject Fedora
- CVE-2026-40021 Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
- CVE-2026-105239 Apache log4net: NUL character truncates EventLogAppender records
- CVE-2026-105240 Apache log4net: NUL character truncates OutputDebugStringAppender records
- CVE-2026-105241 Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch
- CVE-2026-105242 Apache log4net: Request validation failure drops the event in the aspnet-request converter
Sources
Also known as DEBIAN-CVE-2018-1285, DLA-2211-1, GHSA-2cwj-8chv-9pp9, MGASA-2020-0233, UBUNTU-CVE-2018-1285, USN-4699-1 and 1 more.