High severity · published Jan 18, 2022
CVE-2022-23302
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration…
8.8
CVSS
63.8%
EPSS
No
On KEV
Description
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)63.8% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
Log4j · Apache
1.0.1 through 1.2.17 · source: NVD
WS
WebLogic Server · Oracle
12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 · source: NVD
AS
Advanced Supply Chain Planning · Oracle
12.1; 12.2 · source: NVD
BS
Brocade Sannav · Broadcom
All versions, or not specified · source: NVD
BI
Business Intelligence · Oracle
5.9.0.0.0; 12.2.1.3.0; 12.2.1.4.0 · source: NVD
BP
Business Process Management Suite · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
CE
Communications Eagle Ftp Table Base Retrieval · Oracle
4.5 · source: NVD
CI
Communications Instant Messaging Server · Oracle
10.0.1.5.0 · source: NVD
CM
Communications Messaging Server · Oracle
8.1 · source: NVD
CN
Communications Network Integrity · Oracle
7.3.6 · source: NVD
CO
Communications Offline Mediation Controller · Oracle
before 12.0.0.4.4; 12.0.0.5.0 · source: NVD
CU
Communications Unified Inventory Management · Oracle
7.4.1; 7.4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23302
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23302
Mailing List
http://www.openwall.com/lists/oss-security/2022/01/18/3
Mailing List
https://lists.apache.org/thread/bsr3l5qz4g0myrjhy9h67bcxodpkwj4w
Vendor Advisory
https://logging.apache.org/log4j/1.2/index.html
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220217-0006/
Patch
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
https://www.oracle.com/security-alerts/cpujul2022.html
More from Log4j
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
9.0
CVE-2021-45046
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
9.8
CVE-2022-23305
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout
9.8
CVE-2020-9493
Java deserialization in Chainsaw
9.8
CVE-2019-17571
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with…