Improper Output Neutralization for Logs vulnerability in Apache Log4cxx affects versions before 1.5.0. When using JSONLayout, certain non-printable characters in attacker-supplied messages may not be properly escaped, leading to potential misinterpretation of log information by applications. Users are advised to upgrade to version 1.5.0 to resolve this issue.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.3 | CVE-2025-54813 |
Exploitation
An attacker can exploit this vulnerability by sending a specially crafted message containing non-printable characters to an application that uses Apache Log4cxx with JSONLayout. If the application logs this message, the non-printable characters will be included in the log output, potentially leading to issues in log interpretation by other systems.
Affected Products
- Apache Log4cxx: A logging library for C++ that is affected in versions prior to 1.5.0.
Mitigation
To mitigate this vulnerability, users should upgrade to Apache Log4cxx version 1.5.0 or later, which addresses the improper output neutralization issue and ensures that all payload bytes are properly escaped.