CVE-2021-44228

Scores

EPSS

0.944High94.4%
0%20%40%60%80%100%

Percentile: 94.4%

CVSS

9.8Critical3.x
0246810

CVSS Score: 9.8/10

All CVSS Scores

CVSS 3.x
9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0
9.3

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Description

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

debiannvdubuntu

CWEs

CWE-20

Related Vulnerabilities

Exploits

Exploit ID: 50590

Source: exploitdb

URL: https://www.exploit-db.com/exploits/50590

Exploit ID: 50592

Source: exploitdb

URL: https://www.exploit-db.com/exploits/50592

Exploit ID: 51183

Source: exploitdb

URL: https://www.exploit-db.com/exploits/51183

Exploit ID: CVE-2021-44228

Source: github-poc

URL: https://github.com/x1ongsec/CVE-2021-44228-Log4j-JNDI

Recommendations

Source: nvd

In Log4j 2.12.2 (for Java 7) and 2.16.0 (for Java 8 or later) the message lookups feature has been completely removed. In addition, JNDI is disabled by default and other default configuration settings are modified to mitigate CVE-2021-44228 and CVE-2021-45046.For Log4j 1, remove the JMSAppender class or do not configure it. Log4j 1 is not supported and likely contains unfixed bugs and vulnerabilities (such as CVE-2019-17571).For applications, services, and systems that use Log4j, consult the appropriate vendor or provider. See the CISA Log4j Software List and the Vendor Information section below.

URL: https://www.kb.cert.org/vuls/id/930724

Vulnerable Software (178)

Type: Configuration

Product: apache-log4j1.2

Operating System: debian

Trait:
{
  "unaffected": true
}

Source: debian

Type: Configuration

Product: apache-log4j2

Operating System: ubuntu hirsute 21.04

Trait:
{
  "fixed": "2.15.0-0.21.04.1"
}

Source: ubuntu

Type: Configuration

Product: apache-log4j2

Operating System: debian

Trait:
{
  "fixed": "2.15.0-1"
}

Source: debian

Type: Configuration

Product: apache-log4j2

Operating System: ubuntu jammy 22.04

Trait:
{
  "unaffected": true
}

Source: ubuntu

Type: Configuration

Product: apache-log4j2

Operating System: ubuntu trusty 14.04

Trait:
{
  "unfixed": true
}

Source: ubuntu

Type: Configuration

Product: apache-log4j2

Operating System: ubuntu xenial 16.04

Trait:
{
  "unfixed": true
}

Source: ubuntu

Type: Configuration

Product: apache-log4j2

Operating System: ubuntu bionic 18.04

Trait:
{
  "fixed": "2.10.0-2ubuntu0.1"
}

Source: ubuntu

Type: Configuration

Product: apache-log4j2

Operating System: ubuntu impish 21.10

Trait:
{
  "fixed": "2.15.0-0.21.10.1"
}

Source: ubuntu

Type: Configuration

Product: apache-log4j2

Operating System: ubuntu focal 20.04

Trait:
{
  "fixed": "2.15.0-0.20.04.1"
}

Source: ubuntu

Type: Configuration

Vendor: apache

Product: log4j

Operating System: * * *

Trait:
{
  "cpe_match": [
    {
      "cpe23uri": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "2.3.1",
      "versionStartIncluding": "2.0.1",
      "vulnerable": true
    },
    {...

Source: nvd