Improper Input Validation in ch.qos.logback:logback-classic

Summary

Arbitrary Code Execution (ACE) vulnerability in configuration file processing by QOS.CH logback-core through 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file. The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.