Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2022-23302
HistoryJan 18, 2022 - 4:15 p.m.

CVE-2022-23302

2022-01-1816:15:08
CWE-502
[email protected]
web.nvd.nist.gov
2

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.127 Low

EPSS

Percentile

95.5%

JSON

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Affected configurations

NVD
Node
apachelog4jRange1.0.1–1.2.17
Node
netappsnapmanagerMatch-oracle
OR
netappsnapmanagerMatch-sap
Node
broadcombrocade_sannavMatch-
Node
qosreload4jRange<1.2.18.1
Node
oracleadvanced_supply_chain_planningMatch12.1
OR
oracleadvanced_supply_chain_planningMatch12.2
OR
oraclebusiness_intelligenceMatch5.9.0.0.0enterprise
OR
oraclebusiness_intelligenceMatch12.2.1.3.0enterprise
OR
oraclebusiness_intelligenceMatch12.2.1.4.0enterprise
OR
oraclebusiness_process_management_suiteMatch12.2.1.3.0
OR
oraclebusiness_process_management_suiteMatch12.2.1.4.0
OR
oraclecommunications_eagle_ftp_table_base_retrievalMatch4.5
OR
oraclecommunications_instant_messaging_serverMatch10.0.1.5.0
OR
oraclecommunications_messaging_serverMatch8.1
OR
oraclecommunications_network_integrityMatch7.3.6
OR
oraclecommunications_offline_mediation_controllerRange<12.0.0.4.4
OR
oraclecommunications_offline_mediation_controllerMatch12.0.0.5.0
OR
oraclecommunications_unified_inventory_managementMatch7.4.1
OR
oraclecommunications_unified_inventory_managementMatch7.4.2
OR
oraclee-business_suite_cloud_manager_and_cloud_backup_moduleRange<2.2.1.1.1
OR
oraclee-business_suite_cloud_manager_and_cloud_backup_moduleMatch2.2.1.1.1
OR
oracleenterprise_manager_base_platformMatch13.4.0.0
OR
oracleenterprise_manager_base_platformMatch13.5.0.0
OR
oraclefinancial_services_revenue_management_and_billing_analyticsMatch2.7.0.0
OR
oraclefinancial_services_revenue_management_and_billing_analyticsMatch2.7.0.1
OR
oraclefinancial_services_revenue_management_and_billing_analyticsMatch2.8.0.0
OR
oraclehealthcare_foundationMatch8.1.0
OR
oraclehyperion_data_relationship_managementRange<11.2.8.0
OR
oraclehyperion_infrastructure_technologyRange<11.2.8.0
OR
oracleidentity_management_suiteMatch12.2.1.3.0
OR
oracleidentity_management_suiteMatch12.2.1.4.0
OR
oracleidentity_manager_connectorMatch11.1.1.5.0
OR
oraclejdeveloperMatch12.2.1.3.0
OR
oraclemiddleware_common_libraries_and_toolsMatch12.2.1.4.0
OR
oraclemysql_enterprise_monitorRange≤8.0.29
OR
oracletuxedoMatch12.2.2.0.0
OR
oracleweblogic_serverMatch12.2.1.3.0
OR
oracleweblogic_serverMatch12.2.1.4.0
OR
oracleweblogic_serverMatch14.1.1.0.0

Related

f5 1
cvelist 1
cve 1
github 2
osv 8
prion 1
ubuntucve 1
debiancve 1
ibm 89
redhat 21
nessus 33
debian 1
rocky 1
oraclelinux 3
suse 6
openvas 14
almalinux 1
veracode 1
redhatcve 1
cnvd 2
atlassian 2
ubuntu 2
cloudlinux 1
gentoo 2
mageia 1
centos 1
kaspersky 1
f5
f5
K59563964 : Apache Log4j Remote Code Execution vulnerability CVE-2022-23302
2022-01-31 00:00:00
cvelist
cvelist
CVE-2022-23302 Deserialization of untrusted data in JMSSink in Apache Log4j 1.x
2022-01-18 15:25:20
cve
cve
CVE-2022-23302
2022-01-18 16:15:08
github
github
Deserialization of Untrusted Data in Log4j 1.x
2022-01-21 23:27:14
Using JMSAppender in log4j configuration may lead to deserialization of untrusted data
2021-12-17 20:42:38
osv
osv
Deserialization of Untrusted Data in Log4j 1.x
2022-01-21 23:27:14
CVE-2022-23302
2022-01-18 16:15:08
Important: parfait:0.5 security update
2022-01-26 14:27:19
prion
prion
Deserialization of untrusted data
2022-01-18 16:15:00
ubuntucve
ubuntucve
CVE-2022-23302
2022-01-18 00:00:00
debiancve
debiancve
CVE-2022-23302
2022-01-18 16:15:08
ibm
ibm
Security Bulletin: IBM Cognos Controller is affected but not vulnerable to arbitrary code execution and SQL injection due to Apache Log4j v1 vulnerabilities (CVE-2022-23305, CVE-2022-23302, CVE-2021-4104)
2022-06-03 17:41:47
Security Bulletin: Due to use of Apache Log4j, IBM Db2 Web Query for i is vulnerable to arbitrary code execution (CVE-2021-4104, CVE-2022-23302, and CVE-2022-23307) and SQL injection (CVE-2022-23305)
2022-01-25 14:48:34
Security Bulletin: Vulnerability in Apache Log4j affects IBM Netcool Performance Manager
2022-03-19 08:40:04
redhat
redhat
(RHSA-2022:0430) Important: Red Hat Data Grid 7.3.9 security update
2022-02-03 13:55:10
(RHSA-2022:0475) Low: RHV Manager (ovirt-engine) security update [ovirt-4.4.10-1]
2022-02-08 16:46:22
(RHSA-2022:0524) Low: Red Hat JBoss Web Server 3.1 Service Pack 14 Security Update
2022-02-14 16:57:56
nessus
nessus
RHEL 7 / 8 : Red Hat JBoss Enterprise Application Platform 7.4 (RHSA-2022:0436)
2022-02-04 00:00:00
RHEL 8 : parfait:0.5 (RHSA-2022:0291)
2022-09-08 00:00:00
RHEL 8 : parfait:0.5 (RHSA-2022:0294)
2022-09-08 00:00:00
debian
debian
[SECURITY] [DLA 2905-1] apache-log4j1.2 security update
2022-01-31 14:24:44
rocky
rocky
parfait:0.5 security update
2022-01-26 14:27:19
oraclelinux
oraclelinux
parfait:0.5 security update
2022-01-27 00:00:00
log4j security update
2021-12-21 00:00:00
log4j security update
2022-01-26 00:00:00
suse
suse
Security update for kafka (important)
2022-02-16 00:00:00
Security update for kafka (important)
2022-02-17 00:00:00
Security update for log4j12 (important)
2021-12-17 00:00:00
openvas
openvas
Debian: Security Advisory (DLA-2905-1)
2022-02-01 00:00:00
Huawei EulerOS: Security Advisory for log4j (EulerOS-SA-2022-1330)
2022-03-21 00:00:00
Huawei EulerOS: Security Advisory for log4j (EulerOS-SA-2022-1744)
2022-05-25 00:00:00
almalinux
almalinux
Important: parfait:0.5 security update
2022-01-26 14:27:19
veracode
veracode
Deserialisation Of Untrusted Object
2022-01-19 08:50:05
redhatcve
redhatcve
CVE-2022-23302
2022-01-18 15:47:25
cnvd
cnvd
Apache log4j JMSSink deserialization code execution vulnerability
2022-01-20 00:00:00
Apache Log4j Code Execution Vulnerability
2021-12-16 00:00:00
atlassian
atlassian
Jira: Multiple vulnerabilities in log4j < 1.2.17-atlassian-16
2022-06-06 12:49:38
Crowd: Multiple vulnerabilities in log4j < 1.2.7-atlassian-16
2022-05-18 08:53:01
ubuntu
ubuntu
Apache Log4j 1.2 vulnerability
2022-02-08 00:00:00
Apache Log4j 1.2 vulnerability
2022-01-12 00:00:00
cloudlinux
cloudlinux
Fix of CVE: CVE-2021-4104
2022-01-17 14:23:20
gentoo
gentoo
Arduino: Remote Code Execution
2023-12-22 00:00:00
Minecraft Server: Remote Code Execution
2023-12-20 00:00:00
mageia
mageia
Updated davmail packages fix security vulnerability
2023-04-15 22:03:44
centos
centos
log4j security update
2021-12-21 21:36:17
kaspersky
kaspersky
KLA12407 RCE vulnerability in Apache Log4j
2021-12-14 00:00:00

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.127 Low

EPSS

Percentile

95.5%

JSON
Related for NVD:CVE-2022-23302
f51cvelist1cve1github2osv8prion1ubuntucve1debiancve1ibm89redhat21nessus33debian1rocky1oraclelinux3suse6openvas14almalinux1veracode1redhatcve1cnvd2atlassian2ubuntu2cloudlinux1gentoo2mageia1centos1kaspersky1