Back to the CVE list
CVE-2021-44228 CISA KEV · Actively exploitedLinked to ransomware

Improper input validation in Apache Log4j

CVSS score

10.0

EPSS probability

%100.0

Risk score

20.0

Published

4 y ago

OverviewPublic Exploits (11)NewsroomVulnerability Timeline
Official patch verified

Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2021-44228 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2021-44228 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1siemens6bk1602-0aa12-0tp0 firmware View
2siemens6bk1602-0aa12-0tp0 View
3siemens6bk1602-0aa22-0tp0 firmware View
4siemens6bk1602-0aa22-0tp0 View
5siemens6bk1602-0aa32-0tp0 firmware View
6siemens6bk1602-0aa32-0tp0 View
7siemens6bk1602-0aa42-0tp0 firmware View
8siemens6bk1602-0aa42-0tp0 View
9siemens6bk1602-0aa52-0tp0 firmware View
10siemens6bk1602-0aa52-0tp0 View
11apachelog4j View
12apachelog4j View
13apachelog4j View
14apachelog4j View
15siemenssppa-t3000 ses3000 firmware View
16siemenssppa-t3000 ses3000 View
17siemenscapital View
18siemenscapital View
19siemenscomos View
20siemensdesigo cc advanced reports View
21siemensdesigo cc advanced reports View
22siemensdesigo cc advanced reports View
23siemensdesigo cc advanced reports View
24siemensdesigo cc advanced reports View
25siemensdesigo cc advanced reports View
26siemensdesigo cc info center View
27siemensdesigo cc info center View
28siemense-car operation center View
29siemensenergy engage View
30siemensenergyip View
31siemensenergyip View
32siemensenergyip View
33siemensenergyip View
34siemensenergyip prepay View
35siemensgma-manager View
36siemenshead-end system universal device integration system View
37siemensindustrial edge management View
38siemensindustrial edge management hub View
39siemensLOGO! Soft Comfort View
40siemensmendix View
41siemensmindsphere View
42siemensnavigator View
43siemensnx View
44siemensopcenter intelligence View
45siemensoperation scheduler View
46siemenssentron powermanager View
47siemenssentron powermanager View
48siemenssiguard dsa View
49siemenssipass integrated View
50siemenssipass integrated View
51siemenssiveillance command View
52siemenssiveillance control pro View
53siemenssiveillance identity View
54siemenssiveillance identity View
55siemenssiveillance vantage View
56siemenssiveillance viewpoint View
57siemenssolid edge cam pro View
58siemenssolid edge harness design View
59siemenssolid edge harness design View
60siemensspectrum power 4 View
61siemensspectrum power 4 View
62siemensspectrum power 7 View
63siemensspectrum power 7 View
64siemensteamcenter View
65siemensvesys View
66siemensvesys View
67siemensvesys View
68siemensvesys View
69siemensxpedition enterprise View
70siemensxpedition package integrator View
71intelcomputer vision annotation tool View
72inteldatacenter manager View
73intelgenomics kernel library View
74inteloneapi sample browser View
75intelsecure device onboard View
76intelsystem studio View
77debiandebian linux View
78debiandebian linux View
79debiandebian linux View
80fedoraprojectfedora View
81fedoraprojectfedora View
82sonicwallemail security View
83netappactive iq unified manager View
84netappbrocade san navigator View
85netappcloud insights View
86netappcloud manager View
87netappcloud secure agent View
88netapponcommand insight View
89netappontap tools View
90netappsnapcenter View
91netappsolidfire & hci storage node View
92netappsolidfire enterprise sds View
93ciscoadvanced malware protection virtual private cloud appliance View
94ciscoautomated subsea tuning View
95ciscobroadworks View
96ciscobusiness process automation View
97ciscobusiness process automation View
98ciscobusiness process automation View
99ciscocloud connect View
100ciscocloudcenter View
101ciscocloudcenter cost optimizer View
102ciscocloudcenter suite admin View
103ciscocloudcenter workload manager View
104ciscocommon services platform collector View
105ciscocommon services platform collector View
106ciscoconnected mobile experiences View
107ciscocontact center domain manager View
108ciscocontact center management portal View
109ciscocrosswork data gateway View
110ciscocrosswork data gateway View
111ciscocrosswork network controller View
112ciscocrosswork network controller View
113ciscocrosswork optimization engine View
114ciscocrosswork optimization engine View
115ciscocrosswork platform infrastructure View
116ciscocrosswork platform infrastructure View
117ciscocrosswork zero touch provisioning View
118ciscocrosswork zero touch provisioning View
119ciscocustomer experience cloud agent View
120ciscocyber vision sensor management extension View
121ciscodata center network manager View
122ciscodata center network manager View
123ciscodna center View
124ciscodna center View
125ciscodna center View
126ciscodna spaces\ View
127ciscoemergency responder View
128ciscoenterprise chat and email View
129ciscoevolved programmable network manager View
130ciscofinesse View
131ciscofinesse View
132ciscofog director View
133ciscoidentity services engine View
134ciscoidentity services engine View
135ciscointegrated management controller supervisor View
136ciscointersight virtual appliance View
137ciscoiot operations dashboard View
138cisconetwork assurance engine View
139cisconetwork services orchestrator View
140cisconetwork services orchestrator View
141cisconetwork services orchestrator View
142cisconetwork services orchestrator View
143cisconexus dashboard View
144cisconexus insights View
145ciscooptical network controller View
146ciscopackaged contact center enterprise View
147ciscopackaged contact center enterprise View
148ciscopaging server View
149ciscoprime service catalog View
150ciscosd-wan vmanage View
151ciscosd-wan vmanage View
152ciscosd-wan vmanage View
153ciscosd-wan vmanage View
154ciscosmart phy View
155ciscoucs central View
156ciscoucs director View
157ciscounified communications manager View
158ciscounified communications manager View
159ciscounified communications manager View
160ciscounified communications manager im and presence service View
161ciscounified communications manager im and presence service View
162ciscounified contact center enterprise View
163ciscounified contact center enterprise View
164ciscounified contact center express View
165ciscounified customer voice portal View
166ciscounified customer voice portal View
167ciscounified customer voice portal View
168ciscounified customer voice portal View
169ciscounified intelligence center View
170ciscounity connection View
171ciscovideo surveillance operations manager View
172ciscovirtual topology system View
173ciscovirtualized infrastructure manager View
174ciscovirtualized infrastructure manager View
175ciscovirtualized voice browser View
176ciscowan automation engine View
177ciscowebex meetings server View
178ciscowebex meetings server View
179ciscowebex meetings server View
180ciscoworkload optimization manager View
181ciscounified sip proxy View
182ciscounified workforce optimization View
183ciscofirepower 1010 View
184ciscofirepower 1120 View
185ciscofirepower 1140 View
186ciscofirepower 1150 View
187ciscofirepower 2110 View
188ciscofirepower 2120 View
189ciscofirepower 2130 View
190ciscofirepower 2140 View
191ciscofirepower 4110 View
192ciscofirepower 4112 View
193ciscofirepower 4115 View
194ciscofirepower 4120 View
195ciscofirepower 4125 View
196ciscofirepower 4140 View
197ciscofirepower 4145 View
198ciscofirepower 4150 View
199ciscofirepower 9300 View
200ciscofxos View
Total affected vendors: 8|Products: 200

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
10.0CVSS V31CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HNVD
9.3CVSS V2—AV:N/AC:M/Au:N/C:C/I:C/A:CNVD

Patch and Remediation Guide

Solution & Remediation Advisory

Patch verified

6 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
reference

Yama veya çözüm referansı

Open source
reference

Yama veya çözüm referansı

Open source
reference

Yama veya çözüm referansı

Open source
canonical

For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Apply the official update named in the evidence only to the matching product and version.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

CVE-2021-44228 : the database holds 11 public PoC/exploit sources for it. For direct links to the sources, open the Public Exploits tab.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2021-44228 is associated with the following CWEs:

CWE-20: Improper Input ValidationCWE-400: Common Weakness Enumeration Entry CWE-400CWE-502: Deserialization of Untrusted DataCWE-917: Common Weakness Enumeration Entry CWE-917

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2021-44228 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureAğ üzerinden
PermissionsGerekmiyor
UserGerekmiyor

Official Sources and Advisories

http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.htmlnvdhttp://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.htmlnvdhttp://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.htmlnvdhttp://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.htmlnvdhttp://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.htmlnvdhttp://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.htmlnvdhttp://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.htmlnvdhttp://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.htmlnvdhttp://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.htmlnvdhttp://seclists.org/fulldisclosure/2022/Jul/11nvd

CVSS Vector Radar Chart

10.0 / 10
Attack VectorNetworkComplexityLowPrivilegesNoneUser Interact.NoneConfidentialityLowIntegrityNoneAvailabilityHigh

Vulnerability Scoring Details

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone required
User InteractionNone required
Confidentiality (Gizlilik)Low
Integrity (Bütünlük)None
Availability (Erişilebilirlik)High

Yama doğrulandı

6 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

Follow the vendor

S
siemens logo
siemens
A
apache logo
apache
I
intel logo
intel
D
debian logo
debian
F
fedoraproject logo
fedoraproject
S
sonicwall logo
sonicwall

Weakness Type (CWE & CAPEC)

CWE-20 CWE-400 CWE-502 CWE-917

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2021-44228"