Threats tagged 'ghsa-25qh-j22f-pwp8'

QOS.CH logback-core versions prior to 1.5.19 and 1.3.16 are vulnerable to an arbitrary code execution flaw in conditional configuration file processing. Exploitation requires the presence of the Janino library and Spring Framework on the class path, as well as write access to a logback configuration file or the ability to inject a malicious environment variable. The vulnerability allows attackers with existing privileges to execute arbitrary code by compromising or injecting configuration files.