CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
Apache Software Foundation · Apache Log4j2
Vendor fix available · Affected: Apache Software Foundation Apache Log4j2 · Exploitation: in CISA KEV since 10 Dec 2021
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
ExploitationIn CISA KEV
- In CISA KEVCISA KEV catalogue10 Dec 2021
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not established: not seen
Higher than 99% of scored CVEs
DescriptionCVE.org
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Apache Software Foundation · Apache Log4j2from 2.0-beta9 before log4j-core*
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.
- CISA KEV
- Listed since 10 Dec 2021 · known ransomware use · catalogue entry
- Public check
- Apache Log4j2 Remote Code Injection · nuclei template in projectdiscovery/nuclei-templates
- Published
- December 2021
- Bounty reports
- More than 6 disclosed on HackerOne
Disclosed bug bounty reports about CVE-2021-44228
The reports on HackerOne that name this CVE, with HackerOne's own outcome. Titles and metadata only.
- LOGJ4 VUlnerability [HtUS]U.S. Dept Of Defense · 2022 · critical severityValid
- [CVE-2021-44228] nps.acronis.com is vulnerable to the recent log4shell 0-dayAcronis · 2022 · critical severityValid
- [forum.acronis.com] JNDI Code Injection due an outdated log4j componentAcronis · 2024 · critical severityValid
- Log4Shell: RCE 0-day exploit on █████████U.S. Dept Of Defense · 2022 · critical severityValid
- Log4j RCE on https://judge.me/reviewsJudge.me · 2021 · none severityValid
- [CVE-2021-44228] Arbitrary Code Execution on ng01-cloud.acronis.comAcronis · 2024 · critical severityValid
What changed
CoverageNo articles yet
No CyberSIXT article names CVE-2021-44228 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.
References
- NVD entrynvd.nist.gov
- CISA KEV cataloguecisa.gov
- CVE recordcve.org
- Weakness CWE-502cwe.mitre.org
- Vendor advisorytools.cisco.com
- Vendor advisorydebian.org
- Vendor advisorylists.fedoraproject.org
- Vendor advisorymsrc-blog.microsoft.com
- Vendor advisorylists.fedoraproject.org
- logging.apache.org/log4j/2.x/security.htmllogging.apache.org
- security.netapp.com/advisory/ntap-20211210-0007security.netapp.com
- packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remotepacketstormsecurity.com
- psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032psirt.global.sonicwall.com
- oracle.com/security-alerts/alert-cve-2021-44228.htmloracle.com
- Third-party advisorykb.cert.org
- twitter.com/kurtseifried/status/1469345530182455296twitter.com
28 more references are in the CVE record.