{"action":"Upgrade ch.qos.logback:logback-core to 1.3.15 (1.3.x) or 1.5.13 (1.5.x) or later.","affected":[{"fixed":"1.5.13","introduced":"1.4.0"},{"fixed":"1.3.15","introduced":"0"}],"component":"ch.qos.logback:logback-core","cve_ids":["CVE-2024-12798"],"ecosystem":"Maven","epss":0.00458,"exploited":false,"fixed_versions":["1.5.13","1.3.15"],"ghsa_id":"GHSA-pr98-23f8-jwxv","id":"tcs_01M5N97XZ9G6NFNAVW7VR7E2HG","modified_at":"2026-09-10T03:50:21.783184580Z","published_at":"2024-12-19T18:31:37Z","references":["https://osv.dev/vulnerability/GHSA-pr98-23f8-jwxv","https://nvd.nist.gov/vuln/detail/CVE-2024-12798","https://github.com/qos-ch/logback/commit/2cb6d520df7592ef1c3a198f1b5df3c10c93e183","https://github.com/qos-ch/logback","https://logback.qos.ch/news.html#1.3.15","https://logback.qos.ch/news.html#1.5.13"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-pr98-23f8-jwxv","url":"https://osv.dev/vulnerability/GHSA-pr98-23f8-jwxv"}],"summary":"QOS.CH logback-core Expression Language Injection vulnerability"}