CVE-2021-44228 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

🗓️ 10 Dec 2021 00:00:00Reported by apacheType

CVE-2021-44228 Apache Log4j2 security vulnerabilit

Reporter	Title	Published	Views	Family All 1402
GithubExploit	Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware	17 Dec 202108:32	–	githubexploit
GithubExploit	Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware	11 Dec 202116:08	–	githubexploit
GithubExploit	Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware	15 Dec 202113:14	–	githubexploit
GithubExploit	Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware	11 Mar 202212:43	–	githubexploit
GithubExploit	Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware	19 Mar 202615:19	–	githubexploit
GithubExploit	Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware	7 Mar 202410:04	–	githubexploit
GithubExploit	Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware	12 Dec 202113:59	–	githubexploit
GithubExploit	Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware	12 Dec 202111:26	–	githubexploit
GithubExploit	Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware	12 Dec 202115:29	–	githubexploit
GithubExploit	Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware	12 Dec 202112:27	–	githubexploit

[
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache Log4j2",
    "versions": [
      {
        "version": "2.0-beta9",
        "status": "affected",
        "lessThan": "log4j-core*",
        "versionType": "custom",
        "changes": [
          {
            "at": "2.3.1",
            "status": "unaffected"
          },
          {
            "at": "2.4",
            "status": "affected"
          },
          {
            "at": "2.12.2",
            "status": "unaffected"
          },
          {
            "at": "2.13.0",
            "status": "affected"
          },
          {
            "at": "2.15.0",
            "status": "unaffected"
          }
        ]
      }
    ]
  }
]

Source	Link
logging	www.logging.apache.org/log4j/2.x/security.html
openwall	www.openwall.com/lists/oss-security/2021/12/13/2
packetstormsecurity	www.packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html
msrc-blog	www.msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
intel	www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
openwall	www.openwall.com/lists/oss-security/2021/12/10/3
security	www.security.netapp.com/advisory/ntap-20211210-0007/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/
lists	www.lists.debian.org/debian-lts-announce/2021/12/msg00007.html
seclists	www.seclists.org/fulldisclosure/2022/Mar/23

03 Apr 2023 00:00Current

9.1High risk

Vulners AI Score9.1

EPSS0.99999

apache log4j2 security vulnerability ldap_attack