An improper output neutralization for logs vulnerability exists in Apache Log4cxx. When using HTMLLayout, logger names are not properly escaped, allowing an attacker to inject HTML or JavaScript if untrusted data is used. This could lead to information being hidden from logs or data being stolen from users. The issue affects versions before 1.5.0, and users are advised to upgrade to version 1.5.0 to mitigate the risk.
Details
| Severity | Base Score | CVE |
|---|---|---|
| LOW | 2.1 | CVE-2025-54812 |
Exploitation
To exploit this vulnerability, an attacker must configure Log4cxx to use HTMLLayout and provide an untrusted string as the logger name. When a message is logged with this compromised logger name, and the user subsequently opens the generated HTML log file in their browser, it could lead to cross-site scripting (XSS) attacks.
Affected Products
- Apache Log4cxx: Affected versions are those prior to 1.5.0, which do not properly escape logger names in HTMLLayout.
Mitigation
Users are recommended to upgrade to Apache Log4cxx version 1.5.0 or later, which addresses this vulnerability by ensuring proper escaping of logger names when using HTMLLayout.