Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021
Apache Log4j 2 RCE CVE-2021-44228 is actively exploited via crafted JNDI lookups; Palo Alto Unit 42 urges upgrading to Log4j 2.17.1.
92
CVE-2021-44832
- CVSS 3.1
- 6.6 medium
- EPSS
- 98%p100
- Published
- ·
- Modified
Description · NVD
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
- Products
- log4j, communications diameter signaling router, communications interactive session recorder, primavera gateway, primavera p6 enterprise project portfolio management, primavera unifier, retail assortment planning, retail fiscal management, siebel ui framework, weblogic server, cloudcenter, fedora
- Weakness
- CWE-20, CWE-74
- Vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
In the news
13 stories60
60
Two-Fifths of Log4j Apps Use Vulnerable Versions
60
60
60
Threat actors continue to exploit Log4j flaws, Microsoft Warns
60
FTC: Patch Log4j Now or Risk Major Fines
60
60
60
New Apache Log4j Update Released to Patch Newly Discovered Vulnerability
60
Threat Advisory: Critical Apache Log4j vulnerability being exploited in the wild
60
47