10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
log4j is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of LDAP and other JNDI related endpoints allowing an attacker who can control log messages or log message parameters to inject and execute arbitrary code via remote LDAP servers when message lookup substitution is enabled.
CPE | Name | Operator | Version |
---|---|---|---|
apache log4j core | le | 2.14.1 | |
apache log4j core | le | 2.12.1 | |
log4j-jars | le | 2.13.1 | |
apache log4j core | le | 2.14.1 | |
apache log4j core | le | 2.12.1 | |
log4j-jars | le | 2.13.1 |
packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html
packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html
packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html
packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html
packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html
packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html
packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html
packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html
packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html
packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html
packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html
packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html
packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html
seclists.org/fulldisclosure/2022/Dec/2
seclists.org/fulldisclosure/2022/Jul/11
seclists.org/fulldisclosure/2022/Mar/23
www.openwall.com/lists/oss-security/2021/12/10/1
www.openwall.com/lists/oss-security/2021/12/10/2
www.openwall.com/lists/oss-security/2021/12/10/3
www.openwall.com/lists/oss-security/2021/12/13/1
www.openwall.com/lists/oss-security/2021/12/13/2
www.openwall.com/lists/oss-security/2021/12/14/4
www.openwall.com/lists/oss-security/2021/12/15/1
www.openwall.com/lists/oss-security/2021/12/15/3
cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf
cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
github.com/apache/logging-log4j2/pull/608
github.com/cisagov/log4j-affected-db
github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md
github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228
github.com/tangxiaofeng7/CVE-2021-44228-Apache-Log4j-Rce
issues.apache.org/jira/browse/LOG4J2-3198
issues.apache.org/jira/browse/LOG4J2-3201
lists.debian.org/debian-lts-announce/2021/12/msg00007.html
lists.fedoraproject.org/archives/list/[email protected]/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/
lists.fedoraproject.org/archives/list/[email protected]/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/
logging.apache.org/log4j/2.x/security.html
msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
security.netapp.com/advisory/ntap-20211210-0007/
support.apple.com/kb/HT213189
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
twitter.com/kurtseifried/status/1469345530182455296
www.bentley.com/en/common-vulnerability-exposure/be-2022-0001
www.debian.org/security/2021/dsa-5020
www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
www.kb.cert.org/vuls/id/930724
www.nu11secur1ty.com/2021/12/cve-2021-44228.html
www.oracle.com/security-alerts/alert-cve-2021-44228.html
www.oracle.com/security-alerts/cpuapr2022.html
www.oracle.com/security-alerts/cpujan2022.html
y4y.space/2021/12/10/log4j-analysis-more-jndi-injection/
10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C