Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
msrcMicrosoft Security Response CenterMSRC:11EE27B79C8FC8176F733C5748E02C96
HistoryDec 12, 2021 - 8:00 a.m.

Microsoft’s Response to CVE-2021-44228 Apache Log4j 2

2021-12-1208:00:00
Microsoft Security Response Center
msrc.microsoft.com
20

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

10 High

AI Score

Confidence

High

0.975 High

EPSS

Percentile

100.0%

JSON

Published on: 2021 Dec 11, updated 2022 Apr 6. SUMMARY Microsoft continues our analysis of the remote code execution vulnerabilities related to Apache Log4j (a logging tool used in many Java-based applications) disclosed on 9 Dec 2021. Currently, Microsoft is not aware of any impact, outside of the initial disclosure involving Minecraft: Java Edition, to the security of our enterprise services and has not experienced any degradation in availability of those services as a result of this vulnerability.

Related

threatpost 37
ibm 48
msrc 2
cisa_kev 1
githubexploit 44
redhat 4
openvas 7
impervablog 4
nessus 12
cisa 1
rapid7blog 9
mssecure 1
hackerone 3
kaspersky 3
hivepro 1
veracode 1
talosblog 1
fedora 1
amd 1
trellix 1
wallarmlab 2
osv 1
qualysblog 1
packetstorm 3
akamaiblog 1
cve 1
trendmicroblog 1
thn 2
suse 1
malwarebytes 1
metasploit 1
freebsd 1
mageia 1
threatpost
threatpost
Russia May Use Ransomware Payouts to Avoid Sanctions
2022-03-10 14:10:04
Russia Issues Its Own TLS Certs
2022-03-11 18:34:34
Tax-Season Scammers Spoof Fintechs, Including Stash, Public
2022-03-24 13:00:16
ibm
ibm
Security Bulletin: The Apache Log4j (CVE-2021-44228) vulnerability affects z/TPF and TPF Operations Server
2021-12-20 20:53:23
Security Bulletin: Log4JShell Vulnerability affects Watson Knowledge Catalog InstaScan (CVE-2021-44228)
2021-12-17 04:55:42
Security Bulletin: IBM Maximo Application Suite is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)
2022-02-23 18:56:25
msrc
msrc
Microsoft’s Response to CVE-2021-44228 Apache Log4j 2
2021-12-12 05:28:18
CVE-2021-44228 Apache Log4j 2 に対するマイクロソフトの対応
2021-12-12 08:00:00
cisa_kev
cisa_kev
Apache Log4j2 Remote Code Execution Vulnerability
2021-12-10 00:00:00
githubexploit
githubexploit
Exploit for Deserialization of Untrusted Data in Apache Log4J
2021-12-11 13:28:52
Exploit for Deserialization of Untrusted Data in Apache Log4J
2021-12-10 22:19:16
Exploit for Improper Input Validation in Apache Log4J
2021-12-22 15:15:12
redhat
redhat
(RHSA-2021:5126) Critical: Red Hat Integration Camel Extensions for Quarkus GA security update
2021-12-14 16:15:45
(RHSA-2021:5130) Critical: Red Hat Integration Camel-K 1.6.2 release and security update
2021-12-14 17:51:25
(RHSA-2021:5093) Critical: Red Hat build of Eclipse Vert.x 4.1.5 SP1 security update
2021-12-14 15:57:34
openvas
openvas
openSUSE: Security Advisory for logback (openSUSE-SU-2021:1613-1)
2022-02-01 00:00:00
Debian: Security Advisory (DLA-2842-1)
2021-12-13 00:00:00
Apache Struts 2.5.x Log4j RCE Vulnerability (Log4Shell) - Version Check
2021-12-13 00:00:00
impervablog
impervablog
Continuing to Stay Ahead of CVE-2021-44228: Addressing Your Top Questions
2021-12-14 22:55:49
Analytics Are Essential for Effective Database Security
2022-01-13 15:23:02
5 Things We’ve Learned About CVE-2021-44228
2021-12-17 06:44:55
nessus
nessus
FreeBSD : OpenSearch -- Log4Shell (4b1ac5a3-5bd4-11ec-8602-589cfc007716)
2021-12-13 00:00:00
FreeBSD : graylog -- include log4j patches (3fadd7e4-f8fb-45a0-a218-8fd6423c338f)
2021-12-13 00:00:00
VMware vCenter Log4Shell Direct Check (CVE-2021-44228) (VMSA-2021-0028)
2021-12-13 00:00:00
cisa
cisa
Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems
2022-06-23 00:00:00
rapid7blog
rapid7blog
3 Reasons to Join Rapid7’s Cloud Security Summit
2022-03-09 17:06:13
What's New in InsightVM and Nexpose: Q1 2022 in Review
2022-04-19 17:52:17
Metasploit Framework 6.4 Released
2024-03-25 13:33:28
mssecure
mssecure
MERCURY and DEV-1084: Destructive attack on hybrid environment
2023-04-07 16:00:00
hackerone
hackerone
U.S. Dept Of Defense: ██████████ running a vulnerable log4j
2021-12-11 00:16:38
U.S. Dept Of Defense: ███ ████████ running a vulnerable log4j
2021-12-31 00:55:49
Judge.me : Log4j RCE on https://judge.me/reviews
2021-12-15 10:30:12
kaspersky
kaspersky
KLA12392 RCE vulnerability in Microsoft Azure
2021-12-16 00:00:00
KLA12390 RCE vulnerability in Apache Log4j
2021-12-10 00:00:00
KLA12395 RCE vulnerability in Microsoft SQL Server
2021-12-16 00:00:00
hivepro
hivepro
Iranian hackers leveraged Log4Shell to penetrate US federal agency
2022-11-17 12:28:57
veracode
veracode
Remote Code Execution (RCE)
2021-12-10 15:09:45
talosblog
talosblog
How CVSS 4.0 changes (or doesn’t) the way we see vulnerability severity
2024-02-21 13:54:48
fedora
fedora
[SECURITY] Fedora 34 Update: log4j-2.16.0-1.fc34
2021-12-22 01:14:26
amd
amd
AMD Response to Log4j (Log4Shell) Vulnerability
2021-12-15 00:00:00
trellix
trellix
Log4J and The Memory That Knew Too Much
2022-01-19 00:00:00
wallarmlab
wallarmlab
Update on Log4Shell (CVE-2021-44228)
2021-12-10 20:22:36
5 things you must know about Log4Shell
2021-12-11 01:22:39
osv
osv
Critical vulnerability in log4j may affect generated PEAR projects
2021-12-16 21:01:51
qualysblog
qualysblog
Log4Shell – Follow This Multi-Layered Approach for Detection and Remediation
2021-12-28 18:00:00
packetstorm
packetstorm
Intel Data Center Manager 5.1 Local Privilege Escalation
2022-12-09 00:00:00
MobileIron Log4Shell Remote Command Execution
2022-08-03 00:00:00
Log4Shell HTTP Header Injection
2022-01-12 00:00:00
akamaiblog
akamaiblog
Threat Intelligence on Log4j CVE: Key Findings and Their Implications
2021-12-17 19:30:00
cve
cve
CVE-2021-44228
2021-12-10 10:15:09
trendmicroblog
trendmicroblog
Patch Now: Apache Log4j Vulnerability Called Log4Shell Actively Exploited
2021-12-13 00:00:00
thn
thn
Iranian Hackers Compromised a U.S. Federal Agency's Network Using Log4Shell Exploit
2022-11-17 06:22:00
China suspends deal with Alibaba for not sharing Log4j 0-day first with the government
2021-12-22 11:53:00
suse
suse
Security update for log4j (important)
2021-12-13 00:00:00
malwarebytes
malwarebytes
What SMBs can do to protect against Log4Shell attacks
2021-12-15 20:59:31
metasploit
metasploit
VMware vCenter Server Unauthenticated JNDI Injection RCE (via Log4Shell)
2022-01-12 20:34:45
freebsd
freebsd
serviio -- affected by log4j vulnerability
2021-12-13 00:00:00
mageia
mageia
Updated log4j packages fix security vulnerability
2021-12-11 04:02:37

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

10 High

AI Score

Confidence

High

0.975 High

EPSS

Percentile

100.0%

JSON
Related for MSRC:11EE27B79C8FC8176F733C5748E02C96
threatpost37ibm48msrc2cisa_kev1githubexploit44redhat4openvas7impervablog4nessus12cisa1rapid7blog9mssecure1hackerone3kaspersky3hivepro1veracode1talosblog1fedora1amd1trellix1wallarmlab2osv1qualysblog1packetstorm3akamaiblog1cve1trendmicroblog1thn2suse1malwarebytes1metasploit1freebsd1mageia1