Skip to content
OpenAdvisories
Critical VDE-2024-004 1 CVE

TRUMPF: Multiple products affected by log4net vulnerability

Published Apr 22, 2025 · Updated May 22, 2025 · Revision 2

Vendor: TRUMPF Product: Oseon (Storage) Product: TruTops Boost Product: TruTops Cell Product: TruTops Classic Product: TruTops Fab (Storage) Product: TruTops Mark

Summary

The versions of TRUMPF products stated below are including a version of log4net that's prone to XXE
(External XML Entities) attacks under certain circumstances. This means, the log4net code can be tricked
into loading externally hosted, potentially malicious XML code and possibly executing it. This vulnerability allows for the execution of remote XML code, possibly resulting in unauthorized (remote) access to, change of data or disruption of the whole system running the vulnerable application.

Details

Impact
This vulnerability allows for the execution of remote XML code or interpretation of XML config files, possibly resulting in unauthorized (remote) access to, change of data or disruption of the whole system running the vulnerable application.

Remediation
New versions are available for the affected products. Install new versions as provided by TRUMPF SE + Co. KG. To aquire these versions please contact your TRUMPF Service with the PR number 500879.

Vulnerabilities 1

  • Critical 9.8
    CVE-2018-1285 Public exploit EPSS 18%

    XML External Entity attack in log4net

    Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

    log4net log4net log4net Debian Ubuntu NuGet

Revision history

  1. #1.0.1

    Fix: added distribution, quotation mark

  2. #1.0.0

    Initial version

References