[email protected]CVE-2021-45105

HistoryDec 18, 2021 - 12:15 p.m.

CVE-2021-45105

2021-12-1812:15:07

CWE-20

CWE-674

[email protected]

web.nvd.nist.gov

751

In Wild

apache

log4j2

vulnerability

cve-2021-45105

nvd

security

denial of service

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.966 High

EPSS

Percentile

99.6%

JSON

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Affected configurations

Vulners

NVD

Node

apacheapacheRange≤2.17.0

CPENameOperatorVersion
apache:log4japache log4jlt2.3.1
apache:log4japache log4jlt2.12.3
apache:log4japache log4jle2.16.0

CPE	Name	Operator	Version
apache:log4j	apache log4j	lt	2.3.1
apache:log4j	apache log4j	lt	2.12.3
apache:log4j	apache log4j	le	2.16.0

CNA Affected

[
  {
    "product": "Apache Log4j2",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "changes": [
          {
            "at": "2.13.0",
            "status": "affected"
          },
          {
            "at": "2.12.3",
            "status": "unaffected"
          },
          {
            "at": "2.4",
            "status": "affected"
          },
          {
            "at": "2.3.1",
            "status": "unaffected"
          },
          {
            "at": "2.0-alpha1",
            "status": "affected"
          }
        ],
        "lessThan": "2.17.0",
        "status": "affected",
        "version": "log4j-core",
        "versionType": "custom"
      }
    ]
  }
]