High severity · published Dec 14, 2021
CVE-2021-4104
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration
7.5
CVSS
80.6%
EPSS
No
On KEV
Description
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)80.6% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
Log4j · Apache
1.2 · source: NVD
WS
WebLogic Server · Oracle
12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 · source: NVD
AS
Advanced Supply Chain Planning · Oracle
12.1; 12.2 · source: NVD
BI
Business Intelligence · Oracle
5.9.0.0.0; 12.2.1.3.0; 12.2.1.4.0 · source: NVD
BP
Business Process Management Suite · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
CS
Codeready Studio · Redhat
12.0 · source: NVD
CE
Communications Eagle Ftp Table Base Retrieval · Oracle
4.5 · source: NVD
CM
Communications Messaging Server · Oracle
8.1 · source: NVD
CN
Communications Network Integrity · Oracle
7.3.6 · source: NVD
CO
Communications Offline Mediation Controller · Oracle
before 12.0.0.4.0; 12.0.0.5.0 · source: NVD
CU
Communications Unified Inventory Management · Oracle
7.3.4; 7.3.5; 7.4.1; 7.4.2 · source: NVD
ES
E-business Suite Cloud Manager And Cloud Backup Module · Oracle
2.2.1.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-4104
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-4104
www.openwall.com
http://www.openwall.com/lists/oss-security/2022/01/18/3
access.redhat.com
https://access.redhat.com/security/cve/CVE-2021-4104
github.com
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
psirt.global.sonicwall.com
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033
security.gentoo.org
https://security.gentoo.org/glsa/202209-02
security.gentoo.org
https://security.gentoo.org/glsa/202310-16
More from Log4j
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
9.0
CVE-2021-45046
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
9.8
CVE-2022-23305
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout
9.8
CVE-2020-9493
Java deserialization in Chainsaw
9.8
CVE-2019-17571
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with…