| Package | Affected versions | Patched versions |
|---|---|---|
| log4net | < 2.0.10 | 2.0.10 |
| log4net | < 2.0.10 | 2.0.10 |
| application testing suite | = 13.3.0.1 | |
| hospitality opera 5 | = 5.5= 5.6 | |
| hospitality simphony | = 18.2.7.2= 19.1.3 |
Apache log4net before 2.0.10 does not disable XML external entities when parsing log4net configuration files. This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free