Login Request a demo
Critical severity · published Dec 20, 2019
CVE-2019-17571
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with…
9.8
CVSS
70%
EPSS
No
On KEV
Description
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)70.0% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
Log4j · Apache
through 1.2.17 · source: NVD
WS
WebLogic Server · Oracle
10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 · source: NVD
AT
Application Testing Suite · Oracle
13.3.0.1 · source: NVD
BO
Bookkeeper · Apache
before 4.14.3 · source: NVD
CN
Communications Network Integrity · Oracle
7.3.2 through 7.3.6 · source: NVD
DL
Debian Linux · Debian
8.0; 9.0; 10.0 · source: NVD
EI
Endeca Information Discovery Studio · Oracle
3.2.0 · source: NVD
FS
Financial Services Lending And Leasing · Oracle
14.1.0 through 14.8.0; 12.5.0 · source: NVD
LE
Leap · Opensuse
15.1 · source: NVD
ME
Mysql Enterprise Monitor · Oracle
through 8.0.29 · source: NVD
OS
Oncommand System Manager · Netapp
3.0 through 3.1.3 · source: NVD
OW
Oncommand Workflow Automation · Netapp
All versions, or not specified · source: NVD
In the news
VulnerabilityCritical
Dozens of Vendors Patch Security Flaws Across Enterprise Software and Network Devices
SAP has released security updates to address two critical security flaws that could be exploited to achieve arbitrary code execution on affected systems. The vulnerabilities in question listed below - CVE-2019-17571 (CVSS score: 9.8) - A code injection vulnerability in SAP Quotation Management Insurance application (FS-QUO) CVE-2026-27685 (CVSS score: 9.1) - An insecure deserialization
CVE-2019-17571CVE-2026-27685
Mar 11, 2026·The Hacker News
Affected product
LO
Log4j
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-17571
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-17571
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html
lists.apache.org
https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1%40%3Cdev.tika.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c%40%3Cdev.tika.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6%40%3Cdev.tika.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4%40%3Cjira.kafka.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c%40%3Cissues.activemq.apache.org%3E
More from Log4j
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
9.0
CVE-2021-45046
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
9.8
CVE-2022-23305
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout
9.8
CVE-2020-9493
Java deserialization in Chainsaw
9.8
CVE-2017-5645
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary…