Threats tagged 'ghsa-7mpr-gcjx-jcmw'

CVE-2025-54812 is an improper output neutralization vulnerability in Apache Log4cxx affecting versions before 1.5.0. When configured to use HTMLLayout, logger names are not properly escaped in the generated HTML log files. If an attacker can control the logger name, they could inject HTML or JavaScript, potentially causing cross-site scripting (XSS) when the log file is viewed in a browser. The impact is assessed as low because logger names are typically constant strings. The issue is fixed in Apache Log4cxx version 1.5.0.