Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021
Apache Log4j 2 RCE CVE-2021-44228 is actively exploited via crafted JNDI lookups; Palo Alto Unit 42 urges upgrading to Log4j 2.17.1.
92
Vulnerability1 · 1 read
CVE-2019-17571
- CVSS 3.1
- 9.8 critical
- EPSS
- 69%p99
- Published
- ·
- Modified
Description · NVD
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
- Products
- log4j, debian linux, ubuntu linux, leap, oncommand system manager, oncommand workflow automation, application testing suite, communications network integrity, endeca information discovery studio, financial services lending and leasing, mysql enterprise monitor, primavera gateway
- Weakness
- CWE-502
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
3 stories60
60