Critical severity · published Dec 10, 2021
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
RansomwareIn wildKEV
10.0
CVSS
100%
EPSS
Yes
On KEV
Description
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Dec 10, 2021
Federal remediation dueDec 24, 2021
Ransomware campaign useKnown
Affected products
Which versions
LO
Log4j · Apache
2.0.1 before 2.3.1; 2.4.0 before 2.12.2; 2.13.0 before 2.15.0; 2.0; 2.0; 2.0; +1 more · source: NVD, KEV
AL
Apache Log4j2 · Apache Software Foundation
2.0-beta9 before log4j-core* · source: vendor
6F
6bk1602-0aa12-0tp0 Firmware · Siemens
before 2.7.0 · source: NVD
6F
6bk1602-0aa22-0tp0 Firmware · Siemens
before 2.7.0 · source: NVD
6F
6bk1602-0aa32-0tp0 Firmware · Siemens
before 2.7.0 · source: NVD
6F
6bk1602-0aa42-0tp0 Firmware · Siemens
before 2.7.0 · source: NVD
6F
6bk1602-0aa52-0tp0 Firmware · Siemens
before 2.7.0 · source: NVD
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
BS
Brocade San Navigator · Netapp
All versions, or not specified · source: NVD
CA
Capital · Siemens
before 2019.1; 2019.1; 2019.1 · source: NVD
CI
Cloud Insights · Netapp
All versions, or not specified · source: NVD
CM
Cloud Manager · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-44228
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-44228
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logging.apache.org
https://logging.apache.org/log4j/2.x/security.html
mailing-list
http://www.openwall.com/lists/oss-security/2021/12/10/1
mailing-list
http://www.openwall.com/lists/oss-security/2021/12/10/2
vendor-advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
mailing-list
http://www.openwall.com/lists/oss-security/2021/12/10/3
security.netapp.com
https://security.netapp.com/advisory/ntap-20211210-0007/
More from Log4j
9.0
CVE-2021-45046
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
9.8
CVE-2022-23305
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout
9.8
CVE-2020-9493
Java deserialization in Chainsaw
9.8
CVE-2019-17571
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with…
9.8
CVE-2017-5645
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary…