Skip to main content
cve.nowby Sazabi
← Vulnerabilities
CVE-2021-44228GHSA-JFH8-C2JP-5V3Q

Log4Shell: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Affects Apache Log4j2 versions earlier than 2.15.0 when message lookup substitution is enabled. Fixed in Log4j2 2.15.0, and Debian bullseye has 2.15.0-1~deb11u1.

Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.

10.0CriticalCISA-ADP
Exploited
Yes, on CISA KEV
Fix
Fixed in 2.3.1, 2.12.2, 2.15.0
Who is exposed
Not reported

Do first: Upgrade to a fixed version: 2.3.1, 2.12.2, 2.15.0.

Published
Last modified
100.0% · 100th percentile
92/100
Actively exploited
3 on Exploit-DB, 5 Metasploit modules, 505 proofs of concept on GitHub, 1 Nuclei template
  • Exploitation: active
  • Automatable: yes
  • Technical impact: total

Summary

Apache Log4j2, a widely used Java logging library, is affected, and an attacker who can control logged messages or their parameters may be able to run arbitrary code loaded from malicious LDAP or other JNDI servers. This could allow full compromise of the system running the affected software.

Read the original description

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

cve.now Index

92cve.now Index 92 of 100 · methodology v3
  • Exploitation40/40Listed in CISA's Known Exploited Vulnerabilities catalog
  • Exposure25/25Actively exploited, CISA rates it automatable
  • Reach17/20Affects Log4j (a widely deployed server, runtime, framework or database)
  • Severity10/10CVSS 10.0, total technical impact per CISA
  • No patch0/5No signal

How the score works · Rankings

Impact

  • Widely used

    “In fact, data from Sonatype as of February 16, 2022 indicates 39% of Log4j downloads are still versions vulnerable to Log4Shell.”Source: rapid7.com

    3.6k stars on GitHub.Source: apache/logging-log4j2

    241 packages depend on org.apache.logging.log4j:log4j-core.Source: deps.dev

What to do

  • Upgrade to a fixed version: 2.3.1, 2.12.2, 2.15.0.

  • Fix it by , CISA's deadline for US federal agencies.

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

    4 days
  3. Public exploit on Exploit-DB

    EDB-50592, EDB-50590, EDB-51183

    10 days
  4. CISA remediation deadline

    Due date for US federal agencies to patch

    1,138 days (about 3 years)
  5. CISA SSVC assessment

    Exploitation: active · Automatable: yes · Technical impact: total

    259 days
  6. Record last updated377 days (about 1 year)
  7. Exploit code on GitHub

    ShyVictor/minecraft-rce-lab

Affected versions

Show all 11 packagesShow fewer packages

On X 6

Evidence 537

  1. Advisory
  2. Advisory
  3. Advisory
  4. Advisory
  5. Exploit
Show all 537 sourcesShow fewer sources
  1. Exploit
  2. Exploit
  3. Exploit
  4. Exploit
  5. Exploit
  6. Exploit
  7. Exploit
  8. Exploit
  9. Exploit
  10. Exploit
  11. Exploit
  12. Exploit
  13. Exploit
  14. Exploit
  15. Exploit
  16. Exploit
  17. Exploit
  18. Exploit
  19. Exploit
  20. Exploit
  21. Exploit
  22. Exploit
  23. Exploit
  24. Exploit
  25. Exploit
  26. Exploit
  27. Exploit
  28. Exploit
  29. Exploit
  30. Exploit
  31. Exploit
  32. Exploit
  33. Exploit
  34. Exploit
  35. Exploit
  36. Exploit
  37. Exploit
  38. Exploit
  39. Exploit
  40. Exploit
  41. Exploit
  42. Exploit
  43. Exploit
  44. Exploit
  45. Exploit
  46. Exploit
  47. Exploit
  48. Exploit
  49. Exploit
  50. Exploit
  51. Exploit
  52. Exploit
  53. Exploit
  54. Exploit
  55. Exploit
  56. Exploit
  57. Exploit
  58. Exploit
  59. Exploit
  60. Exploit
  61. Exploit
  62. Exploit
  63. Exploit
  64. Exploit
  65. Exploit
  66. Exploit
  67. Exploit
  68. Exploit
  69. Exploit
  70. Exploit
  71. Exploit
  72. Exploit
  73. Exploit
  74. Exploit
  75. Exploit
  76. Exploit
  77. Exploit
  78. Exploit
  79. Exploit
  80. Exploit
  81. Exploit
  82. Exploit
  83. Exploit
  84. Exploit
  85. Exploit
  86. Exploit
  87. Exploit
  88. Exploit
  89. Exploit
  90. Exploit
  91. Exploit
  92. Exploit
  93. Exploit
  94. Exploit
  95. Exploit
  96. Exploit
  97. Exploit
  98. Exploit
  99. Exploit
  100. Exploit
  101. Exploit
  102. Exploit
  103. Exploit
  104. Exploit
  105. Exploit
  106. Exploit
  107. Exploit
  108. Exploit
  109. Exploit
  110. Exploit
  111. Exploit
  112. Exploit
  113. Exploit
  114. Exploit
  115. Exploit
  116. Exploit
  117. Exploit
  118. Exploit
  119. Exploit
  120. Exploit
  121. Exploit
  122. Exploit
  123. Exploit
  124. Exploit
  125. Exploit
  126. Exploit
  127. Exploit
  128. Exploit
  129. Exploit
  130. Exploit
  131. Exploit
  132. Exploit
  133. Exploit
  134. Exploit
  135. Exploit
  136. Exploit
  137. Exploit
  138. Exploit
  139. Exploit
  140. Exploit
  141. Exploit
  142. Exploit
  143. Exploit
  144. Exploit
  145. Exploit
  146. Exploit
  147. Exploit
  148. Exploit
  149. Exploit
  150. Exploit
  151. Exploit
  152. Exploit
  153. Exploit
  154. Exploit
  155. Exploit
  156. Exploit
  157. Exploit
  158. Exploit
  159. Exploit
  160. Exploit
  161. Exploit
  162. Exploit
  163. Exploit
  164. Exploit
  165. Exploit
  166. Exploit
  167. Exploit
  168. Exploit
  169. Exploit
  170. Exploit
  171. Exploit
  172. Exploit
  173. Exploit
  174. Exploit
  175. Exploit
  176. Exploit
  177. Exploit
  178. Exploit
  179. Exploit
  180. Exploit
  181. Exploit
  182. Exploit
  183. Exploit
  184. Exploit
  185. Exploit
  186. Exploit
  187. Exploit
  188. Exploit
  189. Exploit
  190. Exploit
  191. Exploit
  192. Exploit
  193. Exploit
  194. Exploit
  195. Exploit
  196. Exploit
  197. Exploit
  198. Exploit
  199. Exploit
  200. Exploit
  201. Exploit
  202. Exploit
  203. Exploit
  204. Exploit
  205. Exploit
  206. Exploit
  207. Exploit
  208. Exploit
  209. Exploit
  210. Exploit
  211. Exploit
  212. Exploit
  213. Exploit
  214. Exploit
  215. Exploit
  216. Exploit
  217. Exploit
  218. Exploit
  219. Exploit
  220. Exploit
  221. Exploit
  222. Exploit
  223. Exploit
  224. Exploit
  225. Exploit
  226. Exploit
  227. Exploit
  228. Exploit
  229. Exploit
  230. Exploit
  231. Exploit
  232. Exploit
  233. Exploit
  234. Exploit
  235. Exploit
  236. Exploit
  237. Exploit
  238. Exploit
  239. Exploit
  240. Exploit
  241. Exploit
  242. Exploit
  243. Exploit
  244. Exploit
  245. Exploit
  246. Exploit
  247. Exploit
  248. Exploit
  249. Exploit
  250. Exploit
  251. Exploit
  252. Exploit
  253. Exploit
  254. Exploit
  255. Exploit
  256. Exploit
  257. Exploit
  258. Exploit
  259. Exploit
  260. Exploit
  261. Exploit
  262. Exploit
  263. Exploit
  264. Exploit
  265. Exploit
  266. Exploit
  267. Exploit
  268. Exploit
  269. Exploit
  270. Exploit
  271. Exploit
  272. Exploit
  273. Exploit
  274. Exploit
  275. Exploit
  276. Exploit
  277. Exploit
  278. Exploit
  279. Exploit
  280. Exploit
  281. Exploit
  282. Exploit
  283. Exploit
  284. Exploit
  285. Exploit
  286. Exploit
  287. Exploit
  288. Exploit
  289. Exploit
  290. Exploit
  291. Exploit
  292. Exploit
  293. Exploit
  294. Exploit
  295. Exploit
  296. Exploit
  297. Exploit
  298. Exploit
  299. Exploit
  300. Exploit
  301. Exploit
  302. Exploit
  303. Exploit
  304. Exploit
  305. Exploit
  306. Exploit
  307. Exploit
  308. Exploit
  309. Exploit
  310. Exploit
  311. Exploit
  312. Exploit
  313. Exploit
  314. Exploit
  315. Exploit
  316. Exploit
  317. Exploit
  318. Exploit
  319. Exploit
  320. Exploit
  321. Exploit
  322. Exploit
  323. Exploit
  324. Exploit
  325. Exploit
  326. Exploit
  327. Exploit
  328. Exploit
  329. Exploit
  330. Exploit
  331. Exploit
  332. Exploit
  333. Exploit
  334. Exploit
  335. Exploit
  336. Exploit
  337. Exploit
  338. Exploit
  339. Exploit
  340. Exploit
  341. Exploit
  342. Exploit
  343. Exploit
  344. Exploit
  345. Exploit
  346. Exploit
  347. Exploit
  348. Exploit
  349. Exploit
  350. Exploit
  351. Exploit
  352. Exploit
  353. Exploit
  354. Exploit
  355. Exploit
  356. Exploit
  357. Exploit
  358. Exploit
  359. Exploit
  360. Exploit
  361. Exploit
  362. Exploit
  363. Exploit
  364. Exploit
  365. Exploit
  366. Exploit
  367. Exploit
  368. Exploit
  369. Exploit
  370. Exploit
  371. Exploit
  372. Exploit
  373. Exploit
  374. Exploit
  375. Exploit
  376. Exploit
  377. Exploit
  378. Exploit
  379. Exploit
  380. Exploit
  381. Exploit
  382. Exploit
  383. Exploit
  384. Exploit
  385. Exploit
  386. Exploit
  387. Exploit
  388. Exploit
  389. Exploit
  390. Exploit
  391. Exploit
  392. Exploit
  393. Exploit
  394. Exploit
  395. Exploit
  396. Exploit
  397. Exploit
  398. Exploit
  399. Exploit
  400. Exploit
  401. Exploit
  402. Exploit
  403. Exploit
  404. Exploit
  405. Exploit
  406. Exploit
  407. Exploit
  408. Exploit
  409. Exploit
  410. Exploit
  411. Exploit
  412. Exploit
  413. Exploit
  414. Exploit
  415. Exploit
  416. Exploit
  417. Exploit
  418. Exploit
  419. Exploit
  420. Exploit
  421. Exploit
  422. Exploit
  423. Exploit
  424. Exploit
  425. Exploit
  426. Exploit
  427. Exploit
  428. Exploit
  429. Exploit
  430. Exploit
  431. Exploit
  432. Exploit
  433. Exploit
  434. Exploit
  435. Exploit
  436. Exploit
  437. Exploit
  438. Exploit
  439. Exploit
  440. Exploit
  441. Exploit
  442. Exploit
  443. Exploit
  444. Exploit
  445. Exploit
  446. Exploit
  447. Exploit
  448. Exploit
  449. Exploit
  450. Exploit
  451. Exploit
  452. Exploit
  453. Exploit
  454. Exploit
  455. Exploit
  456. Exploit
  457. Exploit
  458. Exploit
  459. Exploit
  460. Exploit
  461. Exploit
  462. Exploit
  463. Exploit
  464. Exploit
  465. Exploit
  466. Exploit
  467. Exploit
  468. Exploit
  469. Exploit
  470. Exploit
  471. Exploit
  472. Exploit
  473. Exploit
  474. Exploit
  475. Exploit
  476. Exploit
  477. Exploit
  478. Exploit
  479. Exploit
  480. Exploit
  481. Exploit
  482. Exploit
  483. Exploit
  484. Exploit
  485. Exploit
  486. Exploit
  487. Exploit
  488. Exploit
  489. Exploit
  490. Exploit
  491. Exploit
  492. Exploit
  493. Exploit
  494. Exploit
  495. Exploit
  496. Exploit
  497. Exploit
  498. Exploit
  499. Exploit
  500. Exploit
  501. Exploit
  502. Exploit
  503. Exploit
  504. Exploit
  505. Exploit
  506. Exploit
  507. Exploit
  508. Exploit
  509. Exploit
  510. Exploit
  511. Exploit
  512. Exploit
  513. Exploit
  514. Link
  515. Link
  516. Link
  517. Link
  518. Link
  519. Link
  520. Link
  521. Link
  522. Link
  523. Link
  524. Link
  525. Link
  526. Link
  527. Link
  528. Link
  529. Link
  530. Link
  531. Link
  532. Link

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about CVE-2021-44228

Is CVE-2021-44228 being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-12-10, which means it has evidence of attacks. US federal agencies must fix it by 2021-12-24. Public exploit code exists (Exploit-DB, Metasploit, a proof of concept on GitHub). Its EPSS score, the predicted chance of exploitation in the next 30 days, reached 10% or higher by 2026-10-22.Source: cisa.gov, cve.now feed data

What does this mean?

Log4j2's JNDI features do not restrict what endpoints they contact. An attacker who can control log messages or log message parameters can make it execute arbitrary code loaded from LDAP servers, when message lookup substitution is enabled.Source: sec.cloudapps.cisco.com, lists.debian.org

Which versions are affected by CVE-2021-44228?

Apache Log4j2: from 2.0-beta9 before 2.3.1; from 2.4 before 2.12.2; from 2.13.0 before 2.15.0. org.apache.logging.log4j:log4j-core (Maven): from 2.13.0 before 2.15.0. org.apache.logging.log4j:log4j-core (Maven): from 2.0-beta9 before 2.3.1. org.apache.logging.log4j:log4j-core (Maven): from 2.4 before 2.12.2. com.guicedee.services:log4j-core (Maven): through 1.2.1.2-jre17. 6 more packages are listed on the page.Source: cve.now feed data

Am I affected, and how do I check?

Apache Log4j2 versions 2.0-beta9 through 2.3.1, 2.4 through 2.12.2, and 2.13.0 through 2.15.0 are listed as affected, along with the log4j-core and pax-logging-log4j2 packages in the affected list. Check the log4j-core or pax-logging version in your dependency files or jar names, and whether message lookup substitution is enabled.Source: sec.cloudapps.cisco.com, lists.debian.org

How do I fix CVE-2021-44228?

Upgrade Apache Log4j2 to 2.15.0 or later. For pax-logging-log4j2, use 1.9.2, 1.10.8, 1.11.10, or 2.0.11 depending on your release line. Debian bullseye has the fix in 2.15.0-1~deb11u1.Source: sec.cloudapps.cisco.com, lists.debian.org

Sources

Known exploitation

Added to CISA KEV on .

Remediation due .

All Apache entries in CISA KEV

CVSS details

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Related

More vulnerabilities