An improper output neutralization for logs vulnerability exists in Apache Log4cxx. When using HTMLLayout, logger names are not properly escaped, allowing an attacker to inject HTML or JavaScript if untrusted data is used. This could lead to information being hidden from logs or data being stolen from users. The impact is assessed as low, affecting versions before 1.5.0.
Details
| Severity | Base Score | CVE |
|---|---|---|
| LOW | 2.1 | CVE-2025-54812 |
Exploitation
To exploit this vulnerability, an attacker must configure Log4cxx to use HTMLLayout and ensure that the logger name is derived from an untrusted string. Once a logger with a compromised name logs a message, the attacker can entice a user to open the generated HTML log file in their browser, potentially leading to cross-site scripting (XSS) attacks.
Affected Products
- Apache Log4cxx: Affected versions are those prior to 1.5.0, which do not properly escape logger names in HTML output.
Mitigation
Users are advised to upgrade to Apache Log4cxx version 1.5.0 or later, which addresses this vulnerability by ensuring proper escaping of logger names in HTML output.