Attacker Value
Unknown
CVE-2021-44832
CVE-2021-44832
(Last updated October 07, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
6.6 Medium
Impact Score:
5.9
Exploitability Score:
0.7
Attack Vector (AV):
Network
Attack Complexity (AC):
High
Privileges Required (PR):
High
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High
General Information
Vendors
- apache,
- cisco,
- debian,
- fedoraproject,
- oracle
Products
- cloudcenter 4.10.0.16,
- communications brm - elastic charging engine,
- communications brm - elastic charging engine 12.0.0.5.0,
- communications diameter signaling router,
- communications interactive session recorder 6.3,
- communications interactive session recorder 6.4,
- communications offline mediation controller,
- communications offline mediation controller 12.0.0.5.0,
- debian linux 9.0,
- fedora 34,
- fedora 35,
- flexcube private banking 12.1.0,
- health sciences data management workbench 2.5.2.1,
- health sciences data management workbench 3.0.0.0,
- health sciences data management workbench 3.1.0.3,
- log4j,
- log4j 2.0,
- policy automation,
- policy automation for mobile devices,
- primavera gateway,
- primavera gateway 21.12.0,
- primavera p6 enterprise project portfolio management,
- primavera p6 enterprise project portfolio management 21.12.0.0,
- primavera unifier 18.8,
- primavera unifier 19.12,
- primavera unifier 20.12,
- primavera unifier 21.12,
- product lifecycle analytics 3.6.1,
- retail assortment planning 16.0.3,
- retail fiscal management 14.2,
- retail order broker 18.0,
- retail order broker 19.1,
- retail xstore point of service 17.0.4,
- retail xstore point of service 18.0.3,
- retail xstore point of service 19.0.2,
- retail xstore point of service 20.0.1,
- retail xstore point of service 21.0.1,
- siebel ui framework,
- siebel ui framework 21.12,
- weblogic server 12.2.1.3.0,
- weblogic server 12.2.1.4.0,
- weblogic server 14.1.1.0.0
References
Advisory
