Published: 20/03/2018 Updated: 27/12/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J prior to 1.8.0-beta2 allows remote malicious users to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.

Vulnerable Product	Search on Vulmon	Subscribe to Product
qos slf4j 1.8.0
qos slf4j
redhat jboss_enterprise_application_platform 7.1
redhat jboss_enterprise_application_platform 6.0.0
redhat jboss_enterprise_application_platform 6.4.0
redhat virtualization 4.0
redhat virtualization_host 4.0
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
redhat enterprise linux server aus 7.4
redhat enterprise linux server tus 7.4
redhat enterprise linux eus 7.4
redhat enterprise linux eus 7.5
redhat enterprise linux server tus 7.6
redhat enterprise linux server aus 7.6
redhat enterprise linux eus 7.6
redhat enterprise linux server aus 7.7
redhat enterprise linux server tus 7.7
redhat enterprise linux eus 7.7
oracle utilities framework 4.2.0.3.0
oracle utilities framework 4.3.0.2.0
oracle utilities framework 4.2.0.2.0
oracle utilities framework 4.3.0.3.0
oracle utilities framework 4.3.0.4.0
oracle utilities framework 4.3.0.5.0
oracle utilities framework 4.3.0.6.0
oracle utilities framework 4.4.0.0.0
oracle goldengate stream analytics
oracle goldengate application adapters 12.3.2.1.0

Debian Bug report logs - #893684 libslf4j-java: CVE-2018-8088: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution Package: src:libslf4j-java; Maintainer for src:libslf4j-java is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso ...

Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution:An XML deserialization vulnerability was discovered in slf4j's EventData which accepts anXML serialized string and can lead to arbitrary code execution (CVE-2018-8088) ...

An XML deserialization vulnerability was discovered in slf4j's EventData, which accepts an XML serialized string and can lead to arbitrary code execution ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 64 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 64 for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7Re ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 64 security update Type/Severity Security Advisory: Important Topic Updated packages that provide Red Hat JBoss Enterprise Application Platform64 and fix three security issues, several bugs, and add variousenhancements are now available fro ...

Synopsis Important: rh-maven35-slf4j security update Type/Severity Security Advisory: Important Topic An update for rh-maven35-slf4j is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring Syste ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 71 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 71 for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7Red Hat Product Security has r ...

Synopsis Important: Red Hat Single Sign-On 722 security update Type/Severity Security Advisory: Important Topic Red Hat Single Sign-On 722 is now available for download from the Customer PortalRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerabilit ...

Synopsis Important: Red Hat JBoss BRMS 6411 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss BRMSRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, w ...

Synopsis Important: Red Hat Decision Manager 701 bug fix and security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat Decision ManagerRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring Syst ...

Synopsis Important: slf4j security update Type/Severity Security Advisory: Important Topic An update for slf4j is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, whi ...

Synopsis Important: Red Hat JBoss Data Grid 72 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Data GridRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base s ...

Synopsis Important: Red Hat JBoss BPM Suite 6411 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss BPM SuiteRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...

Synopsis Important: Red Hat JBoss Data Virtualization 648 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Data VirtualizationRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scorin ...

Synopsis Critical: EAP Continuous Delivery Technical Preview Release 12 security update Type/Severity Security Advisory: Critical Topic This is a security update for JBoss EAP Continuous Delivery 120Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerabil ...

Synopsis Important: Red Hat Fuse 740 security update Type/Severity Security Advisory: Important Topic A minor version update (from 73 to 74) is now available for Red Hat Fuse The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Product Security h ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 6420 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 64 for Red Hat Enterprise Linux 5Red Hat Product Security has rated this update as having a ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 6420 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 64 for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a ...

Synopsis Important: rhvm-appliance security and enhancement update Type/Severity Security Advisory: Important Topic An update for rhvm-appliance is now available for Red Hat Virtualization 4 for RHEL-7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerab ...

Synopsis Important: JBoss Enterprise Application Platform 712 for RHEL 7 Type/Severity Security Advisory: Important Topic Updated packages that provide Red Hat JBoss Enterprise Application Platform 712 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7Re ...

Synopsis Important: Fuse 71 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat FuseRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed s ...

Synopsis Important: jboss-ec2-eap package for EAP 712 Type/Severity Security Advisory: Important Topic An update for eap7-jboss-ec2-eap is now available for Red Hat JBoss Enterprise Application Platform 712 for Red Hat Enterprise Linux 6 and Red Hat JBoss Enterprise Application Platform 712 for Red Ha ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 712 security update Type/Severity Security Advisory: Important Topic Updated packages that provide Red Hat JBoss Enterprise Application Platform 712, fixes several bugs, and adds various enhancements are now available for Red Hat Enterpri ...

Synopsis Important: eap6-jboss-ec2-eap security update Type/Severity Security Advisory: Important Topic An update for jboss-ec2-eap is now available for Red Hat JBoss EnterpriseApplication Platform 64 for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 6420 security update Type/Severity Security Advisory: Important Topic Updated packages that provide Red Hat JBoss Enterprise Application Platform6420, fixes several bugs, and adds various enhancements are now available from the Red Hat Cu ...

Synopsis Important: Red Hat JBoss Operations Network 3311 security and bug fix update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Operations NetworkRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerabi ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 6420 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 64 for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a ...

Synopsis Important: JBoss Enterprise Application Platform 712 on RHEL 6 Type/Severity Security Advisory: Important Topic Updated packages that provide Red Hat JBoss Enterprise Application Platform 712 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6Red ...

Disclaimer Notwithstanding anything that may be contained to the contrary in your agreement(s) with Sysdig, Sysdig provides no support, no updates, and no warranty or guarantee of any kind with respect to these script(s), including as to their functionality or their ability to work in your environment(s) Sysdig disclaims all liability and responsibility with respect to any us

Sample project for OWASP Dependency Check issue 1444 This project contains samples that demonstrate the issues reported in DC issue 1444 issue1444-faulty This folder contains project that shows the reported faulty behaviour when DC plugin is configured as a reporting plugin Running mvn site:site on this project works as expected: a dependency-check report is creeated and the

Get Started

CVE-2018-8088

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect