cbcvebase.
CVE-2018-8088
published 2018-03-20

CVE-2018-8088: org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted…

PriorityP264critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
15.09%
96.4th percentile
org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.

Affected

34 ranges· showing 25
VendorProductVersion rangeFixed in
debianlibslf4j-java< libslf4j-java 1.7.25-3 (bookworm)libslf4j-java 1.7.25-3 (bookworm)
oraclegoldengate_application_adapters
oraclegoldengate_stream_analytics< 19.1.0.0.119.1.0.0.1
oracleutilities_framework
oracleutilities_framework
oracleutilities_framework
oracleutilities_framework
oracleutilities_framework
oracleutilities_framework
oracleutilities_framework
oracleutilities_framework
qosslf4j< 1.7.261.7.26
qosslf4j
qosslf4j
qosslf4j
qosslf4j
redhatenterprise_linux_desktop
redhatenterprise_linux_eus
redhatenterprise_linux_eus
redhatenterprise_linux_eus
redhatenterprise_linux_eus
redhatenterprise_linux_server
redhatenterprise_linux_server_aus
redhatenterprise_linux_server_aus
redhatenterprise_linux_server_aus

Detection & IOCsextracted from sources · hover to see the quote

  • The vulnerability is triggered via XML deserialization in the EventData constructor of the slf4j-ext module (org.slf4j.ext.EventData). Detection should focus on use of the EventData class accepting XML-serialized string input from untrusted sources.
  • The vulnerable code path is in EventData.java at line 80 of the slf4j-ext module. Monitor for loading or instantiation of org.slf4j.ext.EventData with externally supplied XML data.
  • CVE-2018-8088 is also exploitable via jackson-databind polymorphic deserialization (CVE-2018-14718) when slf4j-ext is on the classpath. Detect jackson-databind deserializing objects of type org.slf4j.ext.EventData or related slf4j-ext classes.
  • ·Only the slf4j-ext module is affected; slf4j-api alone is NOT vulnerable. Applications using only slf4j-api (e.g., Red Hat Satellite 6 Candlepin) are not at risk.
  • ·Fixed in SLF4J 1.7.26+ and 2.0.x series. Versions prior to 1.8.0-beta2 / 1.7.26 are vulnerable. Ensure slf4j-ext jar is updated or removed.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8LOW
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.