CVE-2022-23305

🗓️ 18 Jan 2022 15:25:22Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 713 Views🌐 WEB

CVE-2022-23305: Log4j 1.x JDBCAppender allows SQL manipulatio

Reporter	Title	Published	Views	Family All 315
IBM Security Bulletins	Security Bulletin: Due to use of Apache Log4j, IBM Netcool/OMNIbus Probe DSL Factory Framework is vulnerable to arbitrary code execution (CVE-2022-23302, CVE-2022-23307) and SQL injection (CVE-2022-23305)	16 Mar 202202:35	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Datacap	12 Jan 202617:46	–	ibm
IBM Security Bulletins	Security Bulletin: An IBM QRadar SIEM SNMP protocol is vulnerable to a denial of service, SQL injection and could allow a remote attacker to execute arbitrary code on the system.	15 May 202408:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Netcool Impact is affected by an Apache Log4j vulnerability (CVE-2022-23305)	4 Apr 202205:24	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Log4j affects IBM Integrated Analytics System [CVE-2022-23305]	22 Feb 202306:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Jazz for Service Management is vulnerable due to Log4j 1.2 SocketServer Remote Code Execution and Deserialization of Untrusted Data	24 Jun 202511:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to arbitrary code execution and SQL injection due to Apache Log4j. (CVE-2022-23302, CVE-2022-23307, CVE-2022-23305)	17 Feb 202217:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM OpenPages with Watson has addressed Apache Log4j vulnerability (CVE-2022-23305)	11 Jul 202202:17	–	ibm
IBM Security Bulletins	Security Bulletin: Log4j vulnerabilities affect IBM Netezza Analytics	3 Jun 202214:32	–	ibm
IBM Security Bulletins	Security Bulletin: Order Management could be subject to Log4j 1.x vulnerability that could be exploited to remotely execute arbitrary code .	12 Apr 202417:42	–	ibm

NVD

Vulners

Node

apache log4jRange1.2–1.2.17

Node

netapp snapmanagerMatch-oracle

netapp snapmanagerMatch-sap

Node

broadcom brocade_sannavMatch-

Node

qos reload4jRange<1.2.18.2

Node

oracle advanced_supply_chain_planningMatch12.1

oracle advanced_supply_chain_planningMatch12.2

oracle business_intelligenceMatch5.9.0.0.0enterprise

oracle business_intelligenceMatch12.2.1.3.0enterprise

oracle business_intelligenceMatch12.2.1.4.0enterprise

oracle business_process_management_suiteMatch12.2.1.3.0

oracle business_process_management_suiteMatch12.2.1.4.0

oracle communications_eagle_ftp_table_base_retrievalMatch4.5

oracle communications_instant_messaging_serverMatch10.0.1.5.0

oracle communications_messaging_serverMatch8.1

oracle communications_network_integrityMatch7.3.6

oracle communications_offline_mediation_controllerRange<12.0.0.4.4

oracle communications_offline_mediation_controllerMatch12.0.0.5.0

oracle communications_unified_inventory_managementMatch7.4.1

oracle communications_unified_inventory_managementMatch7.4.2

oracle e-business_suite_cloud_manager_and_cloud_backup_moduleRange<2.2.1.1.1

oracle e-business_suite_cloud_manager_and_cloud_backup_moduleMatch2.2.1.1.1

oracle e-business_suite_information_discoveryRange12.2.3–12.2.11

oracle enterprise_manager_base_platformMatch13.4.0.0

oracle enterprise_manager_base_platformMatch13.5.0.0

oracle financial_services_revenue_management_and_billing_analyticsMatch2.7.0.0

oracle financial_services_revenue_management_and_billing_analyticsMatch2.7.0.1

oracle financial_services_revenue_management_and_billing_analyticsMatch2.8.0.0

oracle healthcare_foundationMatch8.1.0

oracle hyperion_data_relationship_managementRange<11.2.8.0

oracle hyperion_infrastructure_technologyRange<11.2.8.0

oracle identity_management_suiteMatch12.2.1.3.0

oracle identity_management_suiteMatch12.2.1.4.0

oracle identity_manager_connectorMatch11.1.1.5.0

oracle jdeveloperMatch12.2.1.3.0

oracle middleware_common_libraries_and_toolsMatch12.2.1.4.0

oracle mysql_enterprise_monitorRange≤8.0.29

oracle retail_extract_transform_and_loadMatch13.2.5

oracle tuxedoMatch12.2.2.0.0

oracle weblogic_serverMatch12.2.1.3.0

oracle weblogic_serverMatch12.2.1.4.0

oracle weblogic_serverMatch14.1.1.0.0

[
  {
    "product": "Apache Log4j 1.x",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "1.2.1",
        "versionType": "custom"
      },
      {
        "lessThan": "2.0-alpha1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2022/01/18/4
oracle	www.oracle.com/security-alerts/cpujul2022.html
logging	www.logging.apache.org/log4j/1.2/index.html
security	www.security.netapp.com/advisory/ntap-20220217-0007/
oracle	www.oracle.com/security-alerts/cpuapr2022.html
lists	www.lists.apache.org/thread/pt6lh3pbsvxqlwlp4c5l798dv2hkc85y

Parameter	Position	Path	Description	CWE
param	query param	/?param=');insert into logs values(':(	SQL injection via JDBCAppender by logging a crafted parameter to trigger unintended SQL when configured with JDBCAppender	CWE-89

17 Jun 2026 04:29Current

9.4High risk

Vulners AI Score9.4

CVSS 26.8

CVSS 3.19.8

EPSS0.66537

SSVC

CWE-89