« Volver al listado

CVE-2023-6481

Estado: ModificadaAlta (7.5)—

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

QOS — Logback

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-6481",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "vulnerability@ncsc.ch",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.5
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vulnerability@ncsc.ch",
      "affectedData": [
        {
          "repo": "https://github.com/qos-ch/logback",
          "vendor": "QOS.CH Sarl",
          "modules": [
            "logback receiver"
          ],
          "product": "logback",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.4.14"
            },
            {
              "status": "unaffected",
              "version": "1.3.14"
            },
            {
              "status": "unaffected",
              "version": "1.2.13"
            }
          ],
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-12-04T09:15:37.250",
  "references": [
    {
      "url": "https://logback.qos.ch/news.html#1.3.12",
      "tags": [
        "Release Notes"
      ],
      "source": "vulnerability@ncsc.ch"
    },
    {
      "url": "https://logback.qos.ch/news.html#1.3.14",
      "tags": [
        "Release Notes"
      ],
      "source": "vulnerability@ncsc.ch"
    },
    {
      "url": "https://logback.qos.ch/news.html#1.3.12",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://logback.qos.ch/news.html#1.3.14",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A serialization vulnerability in logback receiver component part of \nlogback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service \nattack by sending poisoned data.\n\n"
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de serialización en el componente Logback Receiver. Las versiones 1.4.13, 1.3.13 y 1.2.12 de Logback permite a un atacante montar un ataque de denegación de servicio enviando datos envenenados."
    }
  ],
  "lastModified": "2026-06-17T06:50:49.710",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qos:logback:1.2.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "096CE0E0-9128-42CE-9047-DC0E8575920B"
            },
            {
              "criteria": "cpe:2.3:a:qos:logback:1.3.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E9E58AB3-AC12-4C3F-A8A3-A49512F276E9"
            },
            {
              "criteria": "cpe:2.3:a:qos:logback:1.4.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F59BD62-E471-4F2E-A21C-DF6B5950720C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vulnerability@ncsc.ch"
}