Vulnerability CVE-2021-44832
Published: 2021-12-28

Description:
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

Type:

CWE-20

 (Improper Input Validation)

CVSS2 => (AV:N/AC:M/Au:S/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6/10
6.4/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Apache -> Log4j 

 References:
https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143
https://issues.apache.org/jira/browse/LOG4J2-3293
http://www.openwall.com/lists/oss-security/2021/12/28/1
https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf
https://lists.debian.org/debian-lts-announce/2021/12/msg00036.html
https://security.netapp.com/advisory/ntap-20220104-0001/
Copyright 2024, cxsecurity.com

 

Back to Top