Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBME0F75591E2E6874A35B6A6C7681543B81128F5226E803A2CCE1D1B664BFC8638
HistoryDec 17, 2021 - 2:07 p.m.

Security Bulletin: Log4jShell Vulnerability affects IBM SPSS Statistics Server (CVE-2021-44228)

2021-12-1714:07:03
www.ibm.com
195

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.975 High

EPSS

Percentile

99.9%

JSON

Summary

There is a vulnerability in the version of Log4j that is part of IBM SPSS Statistics Server. IBM SPSS Statistics Server has addressed this vulnerability.

Vulnerability Details

CVEID:CVE-2021-44228
**DESCRIPTION:**Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the failure to protect against attacker controlled LDAP and other JNDI related endpoints by JNDI features. By sending a specially crafted code string, an attacker could exploit this vulnerability to load arbitrary Java code on the server and take complete control of the system. Note: The vulnerability is also called Log4Shell or LogJam.
CVSS Base score: 10
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/214921 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM SPSS Statistics Server 28.0.1
IBM SPSS Statistics Server 27.0.1
IBM SPSS Statistics Server 26.0
IBM SPSS Statistics Server 25.0

Remediation/Fixes

Affected Product(s) Version(s) Fixes
SPSS Statistics Server 28.0.1 Statistics 28.0.1-IF003
SPSS Statistics Server 27.0.1 Statistics 27.0.1-IF019
SPSS Statistics Server 26.0 Statistics 26.0.0.1-IF013
SPSS Statistics Server 25.0 Statistics 25.0.0.2-IF013

Workarounds and Mitigations

None

Related

trellix 2
githubexploit 45
ibm 49
wallarmlab 2
threatpost 47
hackerone 3
nessus 9
fedora 2
trendmicroblog 1
rapid7blog 7
hivepro 2
veracode 1
qualysblog 1
cisa 2
packetstorm 5
impervablog 2
amd 1
kaspersky 2
mssecure 1
talosblog 1
msrc 2
cve 1
akamaiblog 1
redhat 3
cisa_kev 1
osv 1
thn 2
github 1
mmpc 1
suse 1
trellix
trellix
Log4J and The Memory That Knew Too Much
2022-01-19 00:00:00
Log4J and The Memory That Knew Too Much
2022-01-19 00:00:00
githubexploit
githubexploit
Exploit for Expression Language Injection in Apache Log4J
2021-12-14 14:51:26
Exploit for Deserialization of Untrusted Data in Apache Log4J
2021-12-13 11:29:57
Exploit for Deserialization of Untrusted Data in Apache Log4J
2021-12-10 22:19:16
ibm
ibm
Security Bulletin: Vulnerabilitiy in Apache Log4jaffects IBM Observability with Instana - Server and Agents (CVE-2021-44228)
2022-01-11 20:10:06
Security Bulletin: IBM Cloud Pak for Applications is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)
2021-12-22 06:59:57
Security Bulletin: IBM Security Verify Privilege Products NOT Affected by CVE-2021-44228 Exploit
2021-12-13 13:37:26
wallarmlab
wallarmlab
Update on Log4Shell (CVE-2021-44228)
2021-12-10 20:22:36
Log4j 0day mitigation update CVE-2021-44228
2021-12-10 20:56:40
threatpost
threatpost
Cyberattackers Target UPS Back-Up Power Devices in Mission-Critical Environments
2022-03-30 17:14:57
Free HermeticRansom Ransomware Decryptor Released
2022-03-04 16:56:27
Wormhole Crypto Platform: 'Funds Are Safe' After $314M Heist
2022-02-03 18:28:14
hackerone
hackerone
U.S. Dept Of Defense: ██████████ running a vulnerable log4j
2021-12-11 00:16:38
U.S. Dept Of Defense: ███ ████████ running a vulnerable log4j
2021-12-31 00:55:49
U.S. Dept Of Defense: Log4Shell: RCE 0-day exploit on █████████
2021-12-16 18:32:13
nessus
nessus
Ubuntu 16.04 ESM : Apache Log4j 2 vulnerability (USN-5192-2)
2021-12-17 00:00:00
FreeBSD : graylog -- include log4j patches (3fadd7e4-f8fb-45a0-a218-8fd6423c338f)
2021-12-13 00:00:00
FreeBSD : OpenSearch -- Log4Shell (4b1ac5a3-5bd4-11ec-8602-589cfc007716)
2021-12-13 00:00:00
fedora
fedora
[SECURITY] Fedora 34 Update: log4j-2.16.0-1.fc34
2021-12-22 01:14:26
[SECURITY] Fedora 34 Update: jansi-2.1.1-4.fc34
2021-12-22 01:14:26
trendmicroblog
trendmicroblog
Patch Now: Apache Log4j Vulnerability Called Log4Shell Actively Exploited
2021-12-13 00:00:00
rapid7blog
rapid7blog
What's New in InsightVM and Nexpose: Q1 2022 in Review
2022-04-19 17:52:17
[Security Nation] Mike Hanley of GitHub on the Log4j Vulnerability
2022-01-19 21:47:30
3 Reasons to Join Rapid7’s Cloud Security Summit
2022-03-09 17:06:13
hivepro
hivepro
Iranian hackers leveraged Log4Shell to penetrate US federal agency
2022-11-17 12:28:57
Monti ransomware infiltrates networks via the well-known Log4Shell
2022-09-16 10:51:13
veracode
veracode
Remote Code Execution (RCE)
2021-12-10 15:09:45
qualysblog
qualysblog
Log4Shell – Follow This Multi-Layered Approach for Detection and Remediation
2021-12-28 18:00:00
cisa
cisa
Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems
2022-06-23 00:00:00
Ivanti Updates Log4j Advisory with Security Updates for Multiple Products  
2022-01-14 00:00:00
packetstorm
packetstorm
Log4Shell HTTP Header Injection
2022-01-12 00:00:00
Intel Data Center Manager 5.1 Local Privilege Escalation
2022-12-09 00:00:00
MobileIron Log4Shell Remote Command Execution
2022-08-03 00:00:00
impervablog
impervablog
Analytics Are Essential for Effective Database Security
2022-01-13 15:23:02
Continuing to Stay Ahead of CVE-2021-44228: Addressing Your Top Questions
2021-12-14 22:55:49
amd
amd
AMD Response to Log4j (Log4Shell) Vulnerability
2021-12-15 00:00:00
kaspersky
kaspersky
KLA12395 RCE vulnerability in Microsoft SQL Server
2021-12-16 00:00:00
KLA12392 RCE vulnerability in Microsoft Azure
2021-12-16 00:00:00
mssecure
mssecure
MERCURY and DEV-1084: Destructive attack on hybrid environment
2023-04-07 16:00:00
talosblog
talosblog
How CVSS 4.0 changes (or doesn’t) the way we see vulnerability severity
2024-02-21 13:54:48
msrc
msrc
CVE-2021-44228 Apache Log4j 2 に対するマイクロソフトの対応
2021-12-12 08:00:00
Microsoft’s Response to CVE-2021-44228 Apache Log4j 2
2021-12-12 05:28:18
cve
cve
CVE-2021-44228
2021-12-10 10:15:00
akamaiblog
akamaiblog
Threat Intelligence on Log4j CVE: Key Findings and Their Implications
2021-12-17 19:30:00
redhat
redhat
(RHSA-2021:5130) Critical: Red Hat Integration Camel-K 1.6.2 release and security update
2021-12-14 17:51:25
(RHSA-2021:5126) Critical: Red Hat Integration Camel Extensions for Quarkus GA security update
2021-12-14 16:15:45
(RHSA-2021:5093) Critical: Red Hat build of Eclipse Vert.x 4.1.5 SP1 security update
2021-12-14 15:57:34
cisa_kev
cisa_kev
Apache Log4j2 Remote Code Execution Vulnerability
2021-12-10 00:00:00
osv
osv
Critical vulnerability in log4j may affect generated PEAR projects
2021-12-16 21:01:51
thn
thn
Last Years Open Source - Tomorrow's Vulnerabilities
2022-11-01 12:04:00
NHS Warns of Hackers Targeting Log4j Flaws in VMware Horizon
2022-01-08 07:04:00
github
github
Apache Log4j Remote Code Execution
2021-12-14 21:07:14
mmpc
mmpc
Build a stronger cybersecurity team through diversity and training
2022-01-20 17:00:00
suse
suse
Security update for log4j (important)
2021-12-12 00:00:00

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.975 High

EPSS

Percentile

99.9%

JSON
Related for E0F75591E2E6874A35B6A6C7681543B81128F5226E803A2CCE1D1B664BFC8638
trellix2githubexploit45ibm49wallarmlab2threatpost47hackerone3nessus9fedora2trendmicroblog1rapid7blog7hivepro2veracode1qualysblog1cisa2packetstorm5impervablog2amd1kaspersky2mssecure1talosblog1msrc2cve1akamaiblog1redhat3cisa_kev1osv1thn2github1mmpc1suse1