Lucene search
This script is Copyright (C) 2021-2024 and is owned by Tenable, Inc. or an Affiliate thereof.VMWARE_VCENTER_LOG4SHELL.NBINHistoryDec 13, 2021 - 12:00 a.m.
VMware vCenter Log4Shell Direct Check (CVE-2021-44228) (VMSA-2021-0028)
2021-12-1300:00:00
This script is Copyright (C) 2021-2024 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
215
vmware vcenter
log4shell
cve-2021-44228
scanner
CVSS2
9.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS3
10
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS
0.967
Percentile
99.7%
A remote code execution vulnerability exists in VMWare vCenter in the bundled Apache Log4j logging library. Apache Log4j is vulnerable due to insufficient protections on message lookup substitutions when dealing with user controlled input. A remote, unauthenticated attacker can explolit this, via a web request, to execute arbitrary code with the permission level of the running Java process.
Binary data vmware_vcenter_log4shell.nbin| Vendor | Product | Version | CPE |
|---|---|---|---|
| vmware | vcenter_server | cpe:/a:vmware:vcenter_server |
Related
ibm
ibm
githubexploit
githubexploit
Exploit for Deserialization of Untrusted Data in Apache Log4J
2022-01-27 07:07:30
Exploit for Deserialization of Untrusted Data in Apache Log4J
2021-12-13 11:29:57
Exploit for Expression Language Injection in Apache Log4J
2021-12-14 14:51:26
fedora
fedora
[SECURITY] Fedora 34 Update: log4j-2.16.0-1.fc34
2021-12-22 01:14:26
[SECURITY] Fedora 35 Update: log4j-2.15.0-1.fc35
2021-12-13 17:13:00
rapid7blog
rapid7blog
Log4Shell Makes Its Appearance in Hacker Chatter: 4 Observations
2021-12-14 21:05:17
[Security Nation] Mike Hanley of GitHub on the Log4j Vulnerability
2022-01-19 21:47:30
What's New in InsightVM and Nexpose: Q1 2022 in Review
2022-04-19 17:52:17
impervablog
impervablog
Continuing to Stay Ahead of CVE-2021-44228: Addressing Your Top Questions
2021-12-14 22:55:49
Analytics Are Essential for Effective Database Security
2022-01-13 15:23:02
2021 in Review, Part 4: 5 Cybersecurity Topics to Watch in 2022
2022-01-04 10:44:57
openvas
openvas
openSUSE: Security Advisory for logback (openSUSE-SU-2021:1613-1)
2022-02-01 00:00:00
Debian: Security Advisory (DLA-2842-1)
2021-12-13 00:00:00
Ubuntu: Security Advisory (USN-5192-1)
2021-12-15 00:00:00
redhat
redhat
nessus
nessus
FreeBSD : graylog -- include log4j patches (3fadd7e4-f8fb-45a0-a218-8fd6423c338f)
2021-12-13 00:00:00
Ubuntu 16.04 ESM : Apache Log4j 2 vulnerability (USN-5192-2)
2021-12-17 00:00:00
VMware Horizon Log4Shell Direct Check (CVE-2021-44228) (VMSA-2021-0028)
2022-01-07 00:00:00
kaspersky
kaspersky
KLA12392 RCE vulnerability in Microsoft Azure
2021-12-16 00:00:00
KLA12395 RCE vulnerability in Microsoft SQL Server
2021-12-16 00:00:00
KLA12390 RCE vulnerability in Apache Log4j
2021-12-10 00:00:00
osv
osv
Critical vulnerability in log4j may affect generated PEAR projects
2021-12-16 21:01:51
apache-log4j2 - security update
2021-12-11 00:00:00
hackerone
hackerone
U.S. Dept Of Defense: ██████████ running a vulnerable log4j
2021-12-11 00:16:38
U.S. Dept Of Defense: ███ ████████ running a vulnerable log4j
2021-12-31 00:55:49
trellix
trellix
Log4J and The Memory That Knew Too Much
2022-01-19 00:00:00
veracode
veracode
Remote Code Execution (RCE)
2021-12-10 15:09:45
threatpost
threatpost
Where the Latest Log4Shell Attacks Are Coming From
2021-12-13 19:00:01
What the Log4Shell Bug Means for SMBs: Experts Weigh In
2021-12-14 17:54:47
The 5 Most-Wanted Threatpost Stories of 2021
2021-12-27 18:57:24
wallarmlab
wallarmlab
Update on Log4Shell (CVE-2021-44228)
2021-12-10 20:22:36
qualysblog
qualysblog
Log4Shell – Follow This Multi-Layered Approach for Detection and Remediation
2021-12-28 18:00:00
Put SecOps in the Driver’s Seat with Custom Assessment and Remediation
2022-05-20 13:00:00
trendmicroblog
trendmicroblog
Patch Now: Apache Log4j Vulnerability Called Log4Shell Actively Exploited
2021-12-13 00:00:00
cisa_kev
cisa_kev
Apache Log4j2 Remote Code Execution Vulnerability
2021-12-10 00:00:00
msrc
msrc
Microsoft’s Response to CVE-2021-44228 Apache Log4j 2
2021-12-12 05:28:18
CVE-2021-44228 Apache Log4j 2 に対するマイクロソフトの対応
2021-12-12 08:00:00
talosblog
talosblog
How CVSS 4.0 changes (or doesn’t) the way we see vulnerability severity
2024-02-21 13:54:48
packetstorm
packetstorm
Intel Data Center Manager 5.1 Local Privilege Escalation
2022-12-09 00:00:00
Log4Shell HTTP Header Injection
2022-01-12 00:00:00
MobileIron Log4Shell Remote Command Execution
2022-08-03 00:00:00
amd
amd
AMD Response to Log4j (Log4Shell) Vulnerability
2021-12-15 00:00:00
hivepro
hivepro
Iranian hackers leveraged Log4Shell to penetrate US federal agency
2022-11-17 12:28:57
akamaiblog
akamaiblog
Threat Intelligence on Log4j CVE: Key Findings and Their Implications
2021-12-17 19:30:00
mssecure
mssecure
MERCURY and DEV-1084: Destructive attack on hybrid environment
2023-04-07 16:00:00
cisa
cisa
cve
cve
CVE-2021-44228
2021-12-10 10:15:09
suse
suse
Security update for logback (important)
2021-12-24 00:00:00
malwarebytes
malwarebytes
CISA Log4Shell warning: Patch VMware Horizon installations immediately
2022-06-27 09:54:58
thn
thn
Extremely Critical Log4J Vulnerability Leaves Much of the Internet at Risk
2021-12-11 04:18:00
Chinese APT Hackers Used Log4Shell Exploit to Target Academic Institution
2021-12-30 10:07:00
Iranian Hackers Exploit Log4j Vulnerability to Deploy PowerShell Backdoor
2022-01-13 08:37:00
debiancve
debiancve
CVE-2021-44228
2021-12-10 10:15:09
kitploit
kitploit
Ox4Shell - Deobfuscate Log4Shell Payloads With Ease
2022-08-24 12:30:00
CVSS2
9.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS3
10
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS
0.967
Percentile
99.7%
Related for VMWARE_VCENTER_LOG4SHELL.NBIN