Skip to content
Fencer Intel
medium 5.4

CVE-2025-54812 json

Apache Log4cxx: Improper HTML escaping in HTMLLayout

published last yr. modified 4mo ago also EUVD-2025-25621

cvss
5.4
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 69%
public exploits
0
none known

Summary

Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.

When using HTMLLayout, logger names are not properly escaped when writing out to the HTML file. If untrusted data is used to retrieve the name of a logger, an attacker could theoretically inject HTML or Javascript in order to hide information from logs or steal data from the user. In order to activate this, the following sequence must occur:

* Log4cxx is configured to use HTMLLayout.

* Logger name comes from an untrusted string

* Logger with compromised name logs a message

* User opens the generated HTML log file in their browser, leading to potential XSS

Because logger names are generally constant strings, we assess the impact to users as LOW

This issue affects Apache Log4cxx: before 1.5.0.

Users are recommended to upgrade to version 1.5.0, which fixes the issue.

Patch / fix

  • Apache Software Foundation Apache Log4cxx 1.5.0
  • log4cxx Debian 12 1.0.0-1+deb12u1
  • log4cxx Debian 13 1.4.0-1+deb13u1
  • log4cxx Debian 14 1.4.0-1.1

debian advisories DEBIAN-CVE-2025-54812

  • log4cxx openSUSE Tumbleweed 1.5.0-1.1

opensuse advisories openSUSE-SU-2025:15549-1

Is CVE-2025-54812 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-54812 updated cvss 5.4

log4cxx: Log4cxx HTMLLayout XSS Vulnerability

  • Red Hat Enterprise Linux 7 log4cxx
    affected: workaround, no fix planned “Out of support scope”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

1.24% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 4.0 2.1 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CNA 4.0 2.1 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

  • Apache Software Foundation Apache Log4cxx

Classification

Weakness
  • CWE-117 Improper Output Neutralization for Logs

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.