Lucene search
IBM19613990614CDAB7F34154F3A620BBF18E7F15F79F3D35FBEB7EC2FC9249AD2CHistoryDec 23, 2021 - 6:45 p.m.
Security Bulletin: IBM Netcool Agile Service Manager is affected by a vulnerability in Apache Log4j (CVE-2021-44228)
2021-12-2318:45:10
www.ibm.com
44
ibm netcool agile service manager
apache log4j
cve-2021-44228
vulnerability
remote code execution
cvss 10
netcool operations insight
on-premise upgrade
EPSS
0.968
Percentile
99.7%
Summary
A vulnerability was identified within the Apache Log4j library that is used by IBM Netcool Agile Service Manager. This vulnerability has been addressed.
Vulnerability Details
CVEID:CVE-2021-44228
**DESCRIPTION:**Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the failure to protect against attacker controlled LDAP and other JNDI related endpoints by JNDI features. By sending a specially crafted code string, an attacker could exploit this vulnerability to load arbitrary Java code on the server and take complete control of the system. Note: The vulnerability is also called Log4Shell or LogJam.
CVSS Base score: 10
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/214921 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| Netcool Operations Insight 1.6 | Netcool Operations Insight 1.6 |
| IBM Netcool Agile Service Manager | 1.1 |
Remediation/Fixes
On-prem
Download IBM Netcool Agile Service Manager V1.1.10 on premise
Workarounds and Mitigations
If you are using 1.1.9 or any earlier versions, you should upgrade to 1.1.10.
Related
githubexploit
githubexploit
Exploit for Deserialization of Untrusted Data in Apache Log4J
2021-12-10 22:19:16
Exploit for Deserialization of Untrusted Data in Apache Log4J
2021-12-11 12:41:38
Exploit for Expression Language Injection in Apache Log4J
2021-12-12 13:00:38
nessus
nessus
FreeBSD : OpenSearch -- Log4Shell (4b1ac5a3-5bd4-11ec-8602-589cfc007716)
2021-12-13 00:00:00
VMware Horizon Log4Shell Direct Check (CVE-2021-44228) (VMSA-2021-0028)
2022-01-07 00:00:00
redhat
redhat
ibm
ibm
wallarmlab
wallarmlab
Update on Log4Shell (CVE-2021-44228)
2021-12-10 20:22:36
msrc
msrc
Microsoft’s Response to CVE-2021-44228 Apache Log4j 2
2021-12-12 05:28:18
CVE-2021-44228 Apache Log4j 2 に対するマイクロソフトの対応
2021-12-12 08:00:00
threatpost
threatpost
Where the Latest Log4Shell Attacks Are Coming From
2021-12-13 19:00:01
What the Log4Shell Bug Means for SMBs: Experts Weigh In
2021-12-14 17:54:47
The 5 Most-Wanted Threatpost Stories of 2021
2021-12-27 18:57:24
impervablog
impervablog
Continuing to Stay Ahead of CVE-2021-44228: Addressing Your Top Questions
2021-12-14 22:55:49
Analytics Are Essential for Effective Database Security
2022-01-13 15:23:02
5 Things We’ve Learned About CVE-2021-44228
2021-12-17 06:44:55
akamaiblog
akamaiblog
cisa_kev
cisa_kev
Apache Log4j2 Remote Code Execution Vulnerability
2021-12-10 00:00:00
talosblog
talosblog
How CVSS 4.0 changes (or doesn’t) the way we see vulnerability severity
2024-02-21 13:54:48
rapid7blog
rapid7blog
3 Reasons to Join Rapid7’s Cloud Security Summit
2022-03-09 17:06:13
Log4Shell Makes Its Appearance in Hacker Chatter: 4 Observations
2021-12-14 21:05:17
[Security Nation] Mike Hanley of GitHub on the Log4j Vulnerability
2022-01-19 21:47:30
openvas
openvas
Debian: Security Advisory (DLA-2842-1)
2021-12-13 00:00:00
openSUSE: Security Advisory for logback (openSUSE-SU-2021:1613-1)
2022-02-01 00:00:00
kaspersky
kaspersky
KLA12395 RCE vulnerability in Microsoft SQL Server
2021-12-16 00:00:00
KLA12390 RCE vulnerability in Apache Log4j
2021-12-10 00:00:00
KLA12392 RCE vulnerability in Microsoft Azure
2021-12-16 00:00:00
packetstorm
packetstorm
MobileIron Log4Shell Remote Command Execution
2022-08-03 00:00:00
Intel Data Center Manager 5.1 Local Privilege Escalation
2022-12-09 00:00:00
Log4Shell HTTP Header Injection
2022-01-12 00:00:00
hackerone
hackerone
U.S. Dept Of Defense: ██████████ running a vulnerable log4j
2021-12-11 00:16:38
U.S. Dept Of Defense: ███ ████████ running a vulnerable log4j
2021-12-31 00:55:49
Judge.me : Log4j RCE on https://judge.me/reviews
2021-12-15 10:30:12
amd
amd
AMD Response to Log4j (Log4Shell) Vulnerability
2021-12-15 00:00:00
veracode
veracode
Remote Code Execution (RCE)
2021-12-10 15:09:45
trellix
trellix
Log4J and The Memory That Knew Too Much
2022-01-19 00:00:00
osv
osv
log4j-2.13.2-2.1 on GA media
2024-06-15 00:00:00
Critical vulnerability in log4j may affect generated PEAR projects
2021-12-16 21:01:51
qualysblog
qualysblog
Log4Shell – Follow This Multi-Layered Approach for Detection and Remediation
2021-12-28 18:00:00
Qualys Study Reveals How Enterprises Responded to Log4Shell
2022-03-18 13:00:00
fedora
fedora
[SECURITY] Fedora 34 Update: log4j-2.16.0-1.fc34
2021-12-22 01:14:26
trendmicroblog
trendmicroblog
Patch Now: Apache Log4j Vulnerability Called Log4Shell Actively Exploited
2021-12-13 00:00:00
hivepro
hivepro
Iranian hackers leveraged Log4Shell to penetrate US federal agency
2022-11-17 12:28:57
cisa
cisa
cve
cve
CVE-2021-44228
2021-12-10 10:15:09
mssecure
mssecure
MERCURY and DEV-1084: Destructive attack on hybrid environment
2023-04-07 16:00:00
malwarebytes
malwarebytes
What SMBs can do to protect against Log4Shell attacks
2021-12-15 20:59:31
freebsd
freebsd
serviio -- affected by log4j vulnerability
2021-12-13 00:00:00
suse
suse
Security update for log4j (important)
2021-12-13 00:00:00
thn
thn
f5
f5
K19026212 : Apache Log4j2 Remote Code Execution vulnerability CVE-2021-44228
2021-12-10 00:00:00
zdt
zdt
Apache Log4j2 2.14.1 - Information Disclosure Exploit
2021-12-14 00:00:00
EPSS
0.968
Percentile
99.7%
Related for 19613990614CDAB7F34154F3A620BBF18E7F15F79F3D35FBEB7EC2FC9249AD2C