Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021
Apache Log4j 2 RCE CVE-2021-44228 is actively exploited via crafted JNDI lookups; Palo Alto Unit 42 urges upgrading to Log4j 2.17.1.
92
CVE-2021-45105
- CVSS 3.1
- 5.9 medium
- EPSS
- 100%p100
- Published
- ·
- Modified
Description · NVD
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
- Products
- log4j, cloud manager, debian linux, email security, network security manager, web application firewall, 6bk1602-0aa12-0tp0 firmware, 6bk1602-0aa22-0tp0 firmware, 6bk1602-0aa32-0tp0 firmware, 6bk1602-0aa42-0tp0 firmware, 6bk1602-0aa52-0tp0 firmware, agile engineering data management
- Weakness
- CWE-20, CWE-674
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
In the news
20 stories60
60
60
60
60
60
60
60
Threat actors continue to exploit Log4j flaws, Microsoft Warns
60
FTC: Patch Log4j Now or Risk Major Fines
60
60
New Apache Log4j Update Released to Patch Newly Discovered Vulnerability
60
60
Answering Log4Shell
60
New Local Attack Vector Expands the Attack Surface of Log4j Vulnerability
60
Apache Issues 3rd Patch to Fix New High
60
60
Threat Advisory: Critical Apache Log4j vulnerability being exploited in the wild
60
47