CVE-2021-44832
highpriority · attend · 70EPSS 0.979 · 100 %ileexploit · PoCDEEURUUSEPSS · scored 2026-10-27
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedNo product currently identified as affectedsiemens_psirt
The table will be updated in case vulnerable products become known.
- FixedFirmware 4.2<4.8.1.4 installed on WAGO Smart Scriptwago_psirt
UPDATE A2/2:Install Version 4.8.1.5 or later of WAGO Smart Script, which is available on our Website.Customers using Version 4.6 or higher can already use the integrated 'Check for update' function of WAGO Smart Script to update to Version 4.8.1.5.END UPDATE A2/2
- FixedCisco Evolved Programmable Network Manager (EPNM)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Network Services Orchestratorcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Unified Communications Manager / Cisco Unity Connectioncisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Unified Communications Manager IM and Presence Servicecisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - MitigationFirmware 4.2<4.8.1.4 installed on WAGO Smart Scriptwago_psirt
Do not use projects from untrusted sources. For further impact information and risk mitigation, see the recommendations of the Apache Foundation https://logging.apache.org/log4j/2.x/security.html Bundesamt für Sicherheit in der Informationstechnik (BSI) https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2021/211211_log4Shell_WarnstufeRot.html
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–8.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (2)
Public proof-of-concept and weaponised exploit code.
- cckuailong/log4j_RCE_CVE-2021-44832cckuailong/log4j_RCE_CVE-2021-44832PoC · poc_in_github
- name/log4j-scannerDiscover Log4Shell vulnerability [CVE-2021-44832]PoC · poc_in_github
affected products (152)
Products and version ranges known to be affected.
- Avaya Aura Application Enablement Servicesall versionscert_bundDEcpe:/a:avaya:aura_application_enablement_services:-
- Cisco Application Policy Infrastructure Controllerall versionscert_bundDEcpe:/a:cisco:application_policy_infrastructure_controller:-
- Cisco Identity Services Engine (ISE)all versionscert_bundDEcpe:/a:cisco:identity_services_engine_software:-
- Cisco Integrated Management Controller Supervisorall versionscert_bundDEcpe:/a:cisco:integrated_management_controller:::supervisor
- Cisco Network Services Orchestratorall versionscert_bundDEcpe:/a:cisco:network_services_orchestrator:-
- Cisco Unified Communications Manager (CUCM)all versionscert_bundDEcpe:/a:cisco:unified_communications_manager:-
- Cisco Unified Communications Manager IM & Presence Serviceall versionscert_bundDEcpe:/a:cisco:unified_communications_manager_im_and_presence_service:-
- Cisco Unified Computing System (UCS) Directorall versionscert_bundDEcpe:/h:cisco:unified_computing_system:director_6.7.4.1
- Cisco Unified Contact Center Enterpriseall versionscert_bundDEcpe:/a:cisco:unified_contact_center_enterprise:-
advisories (13)
Vendor and ecosystem advisories describing this.
- SSA-784507SSA-784507: Apache Log4j Vulnerability (CVE-2021-44832) via JDBC Appender - Impact to Siemens Products2021-12-28csaf · siemens_psirtDE
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) contain a vulnerability (CVE-2021-44832) that could allow an attacker with permission to modify the logging configuration file to execute arbitrary code, when the JDBC Appender is used [1]. This advisory informs about the impact of CVE-2021-44832 to Siemens products and the corresponding remediation and mitigation measures. The vulnerability is different from other JNDI lookup vulnerabilities, the impact of which is documented in SSA-661247 [2]. Currently, no products vulnerable to CVE-2021-44832 have been identified. Siemens is investigating to determine which products are affected and is continuously updating this advisory as more information becomes available. See section Additional Information for more details regarding the investigation status. [1] https://logging.apache.org/log4j/2.x/security.html [2] https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
- VDE-2021-060WAGO: Smart Script affected by Log4Shell Vulnerability2022-01-05csaf · wago_psirtDE
Apache Log4j is used for logging events in WAGO Smart Script in Version 4.2 and higher. Events logged by Log4j can contain JNDI references. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. Additionally, Log4j does not protect from self-referential lookups, which can lead to Denial of Service. UPDATE A1/2: Affected versions: CVE-2021-44228 and CVE-2021-45046: WAGO Smart Script >= Version 4.2 and < Version 4.8.1.3 CVE-2021-45105: WAGO Smart Script >= Version 4.2 and < Version 4.8.1.4 CVE-2021-44832 WAGO Smart Script >= Version 4.2 and < Version 4.8.1.5 END UPDATE A1/2
- WID-SEC-W-2022-0169Oracle MySQL: Mehrere SchwachstellenDeutsch2022-04-19csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2022-0197Apache log4j: Schwachstelle ermöglicht CodeausführungDeutsch2021-12-28csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Apache log4j ausnutzen, um beliebigen Programmcode auszuführen.
- WID-SEC-W-2023-0122Oracle Supply Chain: Mehrere SchwachstellenDeutsch2023-01-17csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Supply Chain ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2023-0123Oracle Siebel CRM: Mehrere SchwachstellenDeutsch2023-01-17csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Siebel CRM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2023-1031Oracle Retail Applications: Mehrere SchwachstellenDeutsch2023-04-18csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Retail Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2023-1524IBM Spectrum Protect Plus: Mehrere SchwachstellenDeutsch2022-01-31csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect Plus ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, seine Privilegien zu erweitern, Sicherheitsmaßnahmen zu umgehen und beliebigen Code auszuführen.
- WID-SEC-W-2024-0064Juniper Produkte: Mehrere SchwachstellenDeutsch2024-01-10csaf · cert_bundDE
Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer, authentisierter, lokaler oder physischer Angreifer kann mehrere Schwachstellen in Juniper JUNOS, Juniper JUNOS Evolved, Juniper SRX Series, Juniper EX Series, Juniper QFX Series, Juniper ACX Series, Juniper PTX Series und Juniper MX Series ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen und seine Berechtigungen zu erweitern.
- WID-SEC-W-2024-2180Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2022-04-19csaf · cert_bundDE
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2025-2471IBM Spectrum Protect Plus: Mehrere SchwachstellenDeutsch2022-01-31csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect ausnutzen, um Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen und beliebigen Code auszuführen.
- cisco-sa-apache-log4j-qRuKNEbdVulnerabilities in Apache Log4j Library Affecting Cisco Products: December 20212021-12-10csaf · cisco_csafUS
Critical Vulnerabilities in Apache Log4j Java Logging Library On December 9, 2021, the following critical vulnerability in the Apache Log4j Java logging library affecting all Log4j2 versions earlier than 2.15.0 was disclosed: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints On December 14, 2021, the following critical vulnerability, which affects certain Apache Log4j use cases in versions 2.15.0 and earlier, was disclosed: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack On December 18, 2021, a vulnerability in the Apache Log4j component affecting versions 2.16 and earlier was disclosed: CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation On December 28, 2021, a vulnerability in the Apache Log4j component affecting versions 2.17 and earlier was disclosed: CVE-2021-44832: Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration For a description of these vulnerabilities, see the Apache Log4j Security Vulnerabilities ["https://logging.apache.org/log4j/2.x/security.html"] page. Cisco's Response to These Vulnerabilities Cisco assessed all products and services for impact from both CVE-2021-44228 and CVE-2021-45046. To help detect exploitation of these vulnerabilities, Cisco has released Snort rules at the following location: Talos Rules 2021-12-21 ["https://www.snort.org/advisories/talos-rules-2021-12-21"] Product fixes that are listed in this advisory will address both CVE-2021-44228 and CVE-2021-45046 unless otherwise noted. Cisco has reviewed CVE-2021-45105 and CVE-2021-44832 and has determined that no Cisco products or cloud offerings are impacted by these vulnerabilities. Cisco's standard practice is to update integrated third-party software components to later versions as they become available.
- GHSA-8489-44mv-ggj8Improper Input Validation and Injection in Apache Log4j22022-01-04ghsa · osvUS
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to an attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2. # Affected packages Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use. This issue does not impact default configurations of Log4j2 and requires an attacker to have control over the Log4j2 configuration, which reduces the likelihood of being exploited.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (89)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2021/12/28/1cnnvd
- https://access.redhat.com/security/cve/cve-2021-44832cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdfcnnvd
- https://issues.apache.org/jira/browse/LOG4J2-3293cnnvd
- https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143cnnvd
- https://lists.debian.org/debian-lts-announce/2021/12/msg00036.htmlcnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA/cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC/cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan