description: Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
problem types: XXE
affected:
{
product: Apache log4net
vendor: n/a
versions:
status: affected, version: Apache log4net up to 2.0.8
}