Home/CVE/Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a r
CVE

CVE-2021-44832

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a r

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

MEDIUM · CVSS 6.6 EPSS 0.53648
Act now
  • EPSS ≥ 0.50 - high probability of exploitation in the next 30 days
  • EPSS percentile: top 2% of all CVEs by exploitation likelihood
Sigma rules10 YARA rules0
◆

Threat Actors Linked

1
actorAquatic Panda
⬡

Weakness Classification

CWE-20Improper Input Validation
CWE-20Improper Input Validation
CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
▤

Affected Products & Versions

36
apache log4j>= 2.0.1 and < 2.3.2
apache log4j>= 2.4 and < 2.12.4
apache log4j>= 2.13.0 and < 2.17.1
apache log4jall versions
oracle communications diameter signaling router>= 8.0.0.0 and <= 8.5.1.0
oracle communications interactive session recorderall versions
oracle primavera gateway>= 17.12.0 and <= 17.12.11
oracle primavera gateway>= 18.8.0 and <= 18.8.13
▤

Affected Packages

2
Language-ecosystem packages (from OSV) tied to this CVE, with the version that fixes it - the dependency-level detail NVD doesn’t carry.
Maven org.apache.logging.log4j:log4j-core MODERATE fixed in 2.3.2
Maven org.ops4j.pax.logging:pax-logging-log4j2 MODERATE fixed in 1.9.2
◈

Detection Rules (IDS/IPS)

38
snort-communitySERVER-OTHER Apache Log4j logging remote code execution attemptattempted-user
snort-communitySERVER-OTHER Apache Log4j logging remote code execution attemptattempted-user
snort-communitySERVER-OTHER Apache Log4j logging remote code execution attemptattempted-user
snort-communitySERVER-OTHER Apache Log4j logging remote code execution attemptattempted-user
snort-communitySERVER-OTHER Apache Log4j logging remote code execution attemptattempted-user
snort-communitySERVER-OTHER Apache Log4j logging remote code execution attemptattempted-user
Open rulesets (ET Open, Snort Community, abuse.ch) link to source. Commercial rulesets are reference-only.
◈

Sigma Hunt Rules

10
Exact rules name this CVE ID. Product rules name an affected product in their title. Related rules cover techniques used by actors who exploited this CVE. Showing the most relevant matches; the complete related set is on the full drill-down.
relatedcriticalAntivirus Password Dumper Detection
relatedcriticalHacktool Execution - Imphash
relatedcriticalHackTool - Rubeus Execution
relatedcriticalPotential Credential Dumping Via LSASS Process Clone
relatedcriticalWCE wceaux.dll Access
relatedcriticalHackTool - Dumpert Process Dumper Default File
▣

Scoring & Timeline

6.6
MEDIUM · CVSS v3.1 · security@apache.org
View on NVD
Attack Vector
Network Adjacent Local Physical
Attack Complexity
Low High
Privileges Required
None Low High
User Interaction
None Required
Scope
Unchanged Changed
Confidentiality
None Low High
Integrity
None Low High
Availability
None Low High
Published to NVD28 Dec 2021 · 08:15 PM
CVSS VectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
⚑

Vendor Advisories

29
suse-csafopenSUSE-SU-2024:11702-1
rhsaRHSA-2022:0467Moderate
rhsaRHSA-2022:1299Moderate
rhsaRHSA-2022:1297Moderate
rhsaRHSA-2022:1296Moderate
🔗

References & Sources

12
Source URLs (vendor pages, mailing lists, write-ups). Exploit/PoC links are in their own section above to avoid duplication.
http://www.openwall.com/lists/oss-security/2021/12/28/1Mailing ListThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdfThird Party Advisory
https://issues.apache.org/jira/browse/LOG4J2-3293Issue TrackingPatchVendor Advisory
https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143Mailing ListVendor Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00036.htmlMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA/
Intelligence Graph · click any node to traverse
CVETechnique ActorTool Family
drag to reposition · click any node to traverse · button top-right enlarges
External lookups - second-class, for what we don’t hold ourselves
NVDCVE.orgCISAVulnersExploit-DBGitHub PoCVulnCheck KEVGreyNoise
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin