Attacker Value
Unknown
CVE-2017-5645
CVE-2017-5645
(Last updated November 08, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
9.8 Critical
Impact Score:
5.9
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High
General Information
Vendors
- apache,
- netapp,
- oracle,
- redhat
Products
- api gateway 11.1.2.4.0,
- application testing suite 13.3.0.1,
- autovue vuelink integration 21.0.0,
- autovue vuelink integration 21.0.1,
- banking platform 2.6.0,
- banking platform 2.6.1,
- banking platform 2.6.2,
- bi publisher 11.1.1.7.0,
- bi publisher 11.1.1.9.0,
- bi publisher 12.2.1.3.0,
- bi publisher 12.2.1.4.0,
- communications converged application server - service controller 6.1,
- communications instant messaging server 10.0.1.3.0,
- communications interactive session recorder,
- communications messaging server,
- communications network integrity,
- communications online mediation controller 6.1,
- communications pricing design center 11.1,
- communications pricing design center 12.0,
- communications service broker 6.0,
- communications webrtc session controller,
- configuration manager 12.1.2.0.2,
- configuration manager 12.1.2.0.5,
- endeca information discovery studio 3.2.0,
- enterprise data quality 12.2.1.3.0,
- enterprise linux 6.0,
- enterprise linux 6.7,
- enterprise linux 7.0,
- enterprise linux 7.3,
- enterprise linux 7.4,
- enterprise linux 7.5,
- enterprise linux 7.6,
- enterprise linux desktop 7.0,
- enterprise linux server 7.0,
- enterprise linux server aus 7.4,
- enterprise linux server aus 7.6,
- enterprise linux server eus 7.4,
- enterprise linux server eus 7.5,
- enterprise linux server eus 7.6,
- enterprise linux server tus 7.4,
- enterprise linux server tus 7.6,
- enterprise linux workstation 7.0,
- enterprise manager base platform 12.1.0.5,
- enterprise manager base platform 13.2.0.0,
- enterprise manager for fusion middleware 12.1.0.5,
- enterprise manager for fusion middleware 13.2.0.0,
- enterprise manager for mysql database,
- enterprise manager for oracle database 12.1.0.8,
- enterprise manager for oracle database 13.2.2,
- enterprise manager for peoplesoft 13.1.1.1,
- enterprise manager for peoplesoft 13.2.1.1,
- financial services analytical applications infrastructure,
- financial services behavior detection platform,
- financial services behavior detection platform 6.1.1,
- financial services hedge management and ifrs valuations 8.0.4,
- financial services hedge management and ifrs valuations 8.0.5,
- financial services lending and leasing,
- financial services lending and leasing 12.5.0,
- financial services loan loss forecasting and provisioning 8.0.4,
- financial services loan loss forecasting and provisioning 8.0.5,
- financial services profitability management,
- financial services profitability management 6.1.1,
- financial services regulatory reporting with agilereporter 8.0.9.2.0,
- flexcube investor servicing 12.0.4,
- flexcube investor servicing 12.1.0,
- flexcube investor servicing 12.3.0,
- flexcube investor servicing 12.4.0,
- flexcube investor servicing 14.0.0,
- fuse 1.0,
- fusion middleware mapviewer 12.2.1.2,
- fusion middleware mapviewer 12.2.1.3,
- goldengate 12.3.2.1.1,
- goldengate application adapters 12.3.2.1.1,
- identity analytics 11.1.1.5.8,
- identity management suite 11.1.2.3.0,
- identity management suite 12.2.1.3.0,
- identity manager connector 9.0,
- in-memory performance-driven planning 12.1,
- in-memory performance-driven planning 12.2,
- instantis enterprisetrack,
- insurance calculation engine 10.1.1,
- insurance calculation engine 10.2.1,
- insurance policy administration 10.0,
- insurance policy administration 10.1,
- insurance policy administration 10.2,
- insurance policy administration 11.0,
- insurance rules palette 10.0,
- insurance rules palette 10.1,
- insurance rules palette 10.2,
- insurance rules palette 11.0,
- insurance rules palette 11.1,
- jd edwards enterpriseone tools 4.0.1.0,
- jd edwards enterpriseone tools 9.2,
- jdeveloper 11.1.1.9.0,
- jdeveloper 12.1.3.0.0,
- jdeveloper 12.2.1.3.0,
- log4j,
- mysql enterprise monitor,
- oncommand api services -,
- oncommand insight -,
- oncommand workflow automation -,
- peoplesoft enterprise fin install 9.2,
- policy automation 10.4.7,
- policy automation 12.1.0,
- policy automation 12.1.1,
- policy automation 12.2.0,
- policy automation 12.2.1,
- policy automation 12.2.10,
- policy automation 12.2.2,
- policy automation 12.2.3,
- policy automation 12.2.4,
- policy automation 12.2.5,
- policy automation 12.2.6,
- policy automation 12.2.7,
- policy automation 12.2.8,
- policy automation 12.2.9,
- policy automation connector for siebel 10.4.6,
- policy automation for mobile devices 10.4.7,
- policy automation for mobile devices 12.1.0,
- policy automation for mobile devices 12.1.1,
- policy automation for mobile devices 12.2.0,
- policy automation for mobile devices 12.2.1,
- policy automation for mobile devices 12.2.10,
- policy automation for mobile devices 12.2.2,
- policy automation for mobile devices 12.2.3,
- policy automation for mobile devices 12.2.4,
- policy automation for mobile devices 12.2.5,
- policy automation for mobile devices 12.2.6,
- policy automation for mobile devices 12.2.7,
- policy automation for mobile devices 12.2.8,
- policy automation for mobile devices 12.2.9,
- primavera gateway,
- rapid planning 12.1,
- rapid planning 12.2,
- retail advanced inventory planning 14.0,
- retail advanced inventory planning 15.0,
- retail clearance optimization engine 14.0.5,
- retail extract transform and load 13.0,
- retail extract transform and load 13.1,
- retail extract transform and load 13.2,
- retail extract transform and load 19.0,
- retail integration bus 14.0.0,
- retail integration bus 14.1.0,
- retail integration bus 15.0,
- retail integration bus 16.0,
- retail open commerce platform 5.3.0,
- retail open commerce platform 6.0.0,
- retail open commerce platform 6.0.1,
- retail predictive application server 15.0.3,
- retail service backbone 14.1,
- retail service backbone 15.0,
- retail service backbone 16.0,
- service level manager -,
- siebel ui framework 18.7,
- siebel ui framework 18.8,
- siebel ui framework 18.9,
- snapcenter -,
- soa suite 12.1.3.0.0,
- soa suite 12.2.1.3.0,
- soa suite 12.2.2.0.0,
- storage automation store -,
- tape library acsls 8.4,
- timesten in-memory database 11.2.2.8.49,
- utilities advanced spatial and operational analytics 2.7.0.1,
- utilities work and asset management 1.9.1.2.12,
- weblogic server 10.3.6.0.0,
- weblogic server 12.1.3.0.0,
- weblogic server 12.2.1.3.0,
- weblogic server 12.2.1.4.0,
- weblogic server 14.1.1.0.0
References
Advisory
Miscellaneous
