Back to the CVE list
CVE-2021-45105

Improper input validation in Apache Log4j

CVSS score

5.9

EPSS probability

%100.0

Risk score

5.9

Published

4 y ago

OverviewPublic Exploits (0)NewsroomVulnerability Timeline
Official patch verified

Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2021-45105 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2021-45105 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1apachelog4j View
2apachelog4j View
3apachelog4j View
4netappcloud manager View
5debiandebian linux View
6debiandebian linux View
7sonicwallemail security View
8sonicwallnetwork security manager View
9sonicwallweb application firewall View
10sonicwall6bk1602-0aa12-0tp0 firmware View
11sonicwall6bk1602-0aa12-0tp0 View
12sonicwall6bk1602-0aa22-0tp0 firmware View
13sonicwall6bk1602-0aa22-0tp0 View
14sonicwall6bk1602-0aa32-0tp0 firmware View
15sonicwall6bk1602-0aa32-0tp0 View
16sonicwall6bk1602-0aa42-0tp0 firmware View
17sonicwall6bk1602-0aa42-0tp0 View
18sonicwall6bk1602-0aa52-0tp0 firmware View
19sonicwall6bk1602-0aa52-0tp0 View
20oracleagile engineering data management View
21oracleagile plm mcad connector View
22oracleagile product lifecycle management View
23oracleautovue for agile product lifecycle management View
24oraclebanking deposits and lines of credit servicing View
25oraclebanking enterprise default management View
26oraclebanking enterprise default management View
27oraclebanking loans servicing View
28oraclebanking party management View
29oraclebanking payments View
30oraclebanking platform View
31oraclebanking platform View
32oraclebanking platform View
33oraclebanking trade finance View
34oraclebanking treasury management View
35oraclebusiness intelligence View
36oraclecommunications asap View
37oraclecommunications billing and revenue management View
38oraclecommunications billing and revenue management View
39oraclecommunications cloud native core console View
40oraclecommunications cloud native core network function cloud native environment View
41oraclecommunications cloud native core network repository function View
42oraclecommunications cloud native core network repository function View
43oraclecommunications cloud native core network slice selection function View
44oraclecommunications cloud native core policy View
45oraclecommunications cloud native core security edge protection proxy View
46oraclecommunications cloud native core service communication proxy View
47oraclecommunications cloud native core unified data repository View
48oraclecommunications convergence View
49oraclecommunications convergence View
50oraclecommunications convergent charging controller View
51oraclecommunications convergent charging controller View
52oraclecommunications diameter signaling router View
53oraclecommunications eagle element management system View
54oraclecommunications eagle ftp table base retrieval View
55oraclecommunications element manager View
56oraclecommunications evolved communications application server View
57oraclecommunications interactive session recorder View
58oraclecommunications interactive session recorder View
59oraclecommunications ip service activator View
60oraclecommunications messaging server View
61oraclecommunications network charging and control View
62oraclecommunications network charging and control View
63oraclecommunications network integrity View
64oraclecommunications performance intelligence center View
65oraclecommunications pricing design center View
66oraclecommunications pricing design center View
67oraclecommunications service broker View
68oraclecommunications services gatekeeper View
69oraclecommunications session report manager View
70oraclecommunications session route manager View
71oraclecommunications unified inventory management View
72oraclecommunications unified inventory management View
73oraclecommunications unified inventory management View
74oraclecommunications user data repository View
75oraclecommunications webrtc session controller View
76oraclecommunications webrtc session controller View
77oracledata integrator View
78oracledata integrator View
79oraclee-business suite View
80oracleenterprise manager base platform View
81oracleenterprise manager base platform View
82oracleenterprise manager for peoplesoft View
83oracleenterprise manager for peoplesoft View
84oracleenterprise manager ops center View
85oraclefinancial services analytical applications infrastructure View
86oraclefinancial services model management and governance View
87oraclefinancial services model management and governance View
88oraclefinancial services model management and governance View
89oracleflexcube universal banking View
90oracleflexcube universal banking View
91oracleflexcube universal banking View
92oracleflexcube universal banking View
93oraclehealth sciences empirica signal View
94oraclehealth sciences empirica signal View
95oraclehealth sciences inform View
96oraclehealth sciences inform View
97oraclehealth sciences inform View
98oraclehealth sciences information manager View
99oraclehealthcare data repository View
100oraclehealthcare foundation View
101oraclehealthcare master person index View
102oraclehealthcare translational research View
103oraclehealthcare translational research View
104oraclehospitality suite8 View
105oraclehospitality suite8 View
106oraclehospitality token proxy service View
107oraclehyperion bi+ View
108oraclehyperion data relationship management View
109oraclehyperion infrastructure technology View
110oraclehyperion planning View
111oraclehyperion profitability and cost management View
112oraclehyperion tax provision View
113oracleidentity management suite View
114oracleidentity management suite View
115oracleidentity manager connector View
116oracleinstantis enterprisetrack View
117oracleinstantis enterprisetrack View
118oracleinstantis enterprisetrack View
119oracleinsurance data gateway View
120oracleinsurance insbridge rating and underwriting View
121oracleinsurance insbridge rating and underwriting View
122oracleinsurance insbridge rating and underwriting View
123oraclejdeveloper View
124oraclemanaged file transfer View
125oraclemanaged file transfer View
126oraclemanagement cloud engine View
127oraclemysql enterprise monitor View
128oraclepayment interface View
129oraclepayment interface View
130oraclepeoplesoft enterprise peopletools View
131oraclepeoplesoft enterprise peopletools View
132oracleprimavera gateway View
133oracleprimavera gateway View
134oracleprimavera gateway View
135oracleprimavera gateway View
136oracleprimavera gateway View
137oracleprimavera p6 enterprise project portfolio management View
138oracleprimavera p6 enterprise project portfolio management View
139oracleprimavera p6 enterprise project portfolio management View
140oracleprimavera unifier View
141oracleprimavera unifier View
142oracleprimavera unifier View
143oracleprimavera unifier View
144oracleretail back office View
145oracleretail central office View
146oracleretail customer insights View
147oracleretail customer insights View
148oracleretail data extractor for merchandising View
149oracleretail data extractor for merchandising View
150oracleretail eftlink View
151oracleretail eftlink View
152oracleretail eftlink View
153oracleretail eftlink View
154oracleretail eftlink View
155oracleretail eftlink View
156oracleretail financial integration View
157oracleretail financial integration View
158oracleretail financial integration View
159oracleretail financial integration View
160oracleretail financial integration View
161oracleretail integration bus View
162oracleretail integration bus View
163oracleretail integration bus View
164oracleretail integration bus View
165oracleretail integration bus View
166oracleretail integration bus View
167oracleretail integration bus View
168oracleretail invoice matching View
169oracleretail invoice matching View
170oracleretail merchandising system View
171oracleretail merchandising system View
172oracleretail order broker View
173oracleretail order broker View
174oracleretail order broker View
175oracleretail order management system View
176oracleretail point-of-service View
177oracleretail predictive application server View
178oracleretail predictive application server View
179oracleretail predictive application server View
180oracleretail price management View
181oracleretail price management View
182oracleretail price management View
183oracleretail price management View
184oracleretail price management View
185oracleretail returns management View
186oracleretail service backbone View
187oracleretail service backbone View
188oracleretail service backbone View
189oracleretail service backbone View
190oracleretail service backbone View
191oracleretail service backbone View
192oracleretail service backbone View
193oracleretail store inventory management View
194oracleretail store inventory management View
195oracleretail store inventory management View
196oracleretail store inventory management View
197oracleretail store inventory management View
198oracleretail store inventory management View
199oraclesiebel ui framework View
200oraclesql developer View
Total affected vendors: 5|Products: 200

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
5.9CVSS V31MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
4.3CVSS V2—AV:N/AC:M/Au:N/C:N/I:N/A:PNVD

Patch and Remediation Guide

Solution & Remediation Advisory

Patch verified

4 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
reference

Yama veya çözüm referansı

Open source
reference

Yama veya çözüm referansı

Open source
Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Apply the official update named in the evidence only to the matching product and version.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2021-45105 is associated with the following CWEs:

CWE-20: Improper Input ValidationCWE-674: Common Weakness Enumeration Entry CWE-674

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2021-45105 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureAğ üzerinden
PermissionsGerekmiyor
UserGerekmiyor

Official Sources and Advisories

http://www.openwall.com/lists/oss-security/2021/12/19/1nvdhttps://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdfnvdhttps://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdfnvdhttps://logging.apache.org/log4j/2.x/security.htmlvendor-advisoryhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032nvdhttps://security.netapp.com/advisory/ntap-20211218-0001/nvdhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbdnvdhttps://www.debian.org/security/2021/dsa-5024nvdhttps://www.kb.cert.org/vuls/id/930724nvdhttps://www.oracle.com/security-alerts/cpuapr2022.htmlpatch

CVSS Vector Radar Chart

5.9 / 10
Attack VectorNetworkComplexityHighPrivilegesNoneUser Interact.NoneConfidentialityHighIntegrityNoneAvailabilityHigh

Vulnerability Scoring Details

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredNone required
User InteractionNone required
Confidentiality (Gizlilik)High
Integrity (Bütünlük)None
Availability (Erişilebilirlik)High

Yama doğrulandı

4 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

Follow the vendor

A
apache logo
apache
N
netapp logo
netapp
D
debian logo
debian
S
sonicwall logo
sonicwall
O
oracle logo
oracle

Weakness Type (CWE & CAPEC)

CWE-20 CWE-674

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2021-45105"