CVE-2024-12798

🗓️ 19 Dec 2024 23:50:14Reported by redhat.comType

redhatcve

redhatcve🔗 access.redhat.com👁 12 Views

ACE vulnerability in JaninoEventEvaluator allows arbitrary code execution via compromised logback files.

Reporter	Title	Published	Views	Family All 90
IBM Security Bulletins	Security Bulletin: SSRF Vulnerability in QOS.CH Logback via Malicious DOCTYPE in XML Config (v0.1–1.3.14, 1.4.0–1.5.12)	23 Jul 202510:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	6 Feb 202617:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Asset Data Dictionary uses multiple third party dependencies which is vulnerable to CVEs.	6 Feb 202505:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition (ITNM).	29 May 202515:46	–	ibm
IBM Security Bulletins	Security Bulletin: Netty Vulnerability Affects IBM Watson Machine Learning on CP4D (CVE-2021-21295)	16 Jan 202608:37	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of QOS.CH logback, IBM Cloud Pak System is affected by server-side request forgery and arbitrary code execution	6 Nov 202507:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Automation Decision Services for October 2025 - Multiple CVEs addressed	3 Dec 202506:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Broker Component uses CVE-2024-12798 logback-classic-1.5.12.jar (Publicly disclosed vulnerability found by Mend) CVE-2024-12798	20 Feb 202506:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a denial of service in logback-classic [CVE-2024-12798]	27 Feb 202517:07	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Logback, IBM Operations Analytics - Log Analysis is affected by Server‑Side Request Forgery (SSRF), and arbitrary code is being executed.	6 Apr 202613:37	–	ibm

Source	Link
cve	www.cve.org/CVERecord
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-12798
logback	www.logback.qos.ch/news.html
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

30 Jan 2025 14:23Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.15.5

EPSS0.00169

cve 2024 12798 ace vulnerability java applications arbitrary code execution logback configuration files malicious environment variable existing privilege.