CVE-2021-45105
Improper input validation in Apache Log4j
CVSS Skor
5.9
EPSS İhtimal
%100.0
Risk Skoru
5.9
Yayın
4 yıl önce
Resmî yama doğrulandı
Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.
Envanterimdeki Etkisi
Yalnızca hesabınıza eklediğiniz kişisel ürünler değerlendirilir; kurumsal envanter burada görünmez.
Oturum kontrol ediliyor…
Zafiyet Açıklaması
DayBreach CVE AI Araştırması
CVE-2021-45105 için toplanan üretici, dağıtım, yama ve güvenlik kaynağı kayıtlarını karşılaştırıp kanıt bağlantılı bir açıklama hazırlayalım.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
IMPACT — Etkilenen Ürünler ve Yazılımlar
Affected Products
The following products are affected by CVE-2021-45105 vulnerability. Even if our threat engine is aware of the exact versions of the products that are affected, the information is represented below.
| ID | VENDOR | PRODUCT | ACTION |
|---|---|---|---|
| 1 | apache | log4j | İncele |
| 2 | apache | log4j | İncele |
| 3 | apache | log4j | İncele |
| 4 | netapp | cloud manager | İncele |
| 5 | debian | debian linux | İncele |
| 6 | debian | debian linux | İncele |
| 7 | sonicwall | email security | İncele |
| 8 | sonicwall | network security manager | İncele |
| 9 | sonicwall | web application firewall | İncele |
| 10 | sonicwall | 6bk1602-0aa12-0tp0 firmware | İncele |
| 11 | sonicwall | 6bk1602-0aa12-0tp0 | İncele |
| 12 | sonicwall | 6bk1602-0aa22-0tp0 firmware | İncele |
| 13 | sonicwall | 6bk1602-0aa22-0tp0 | İncele |
| 14 | sonicwall | 6bk1602-0aa32-0tp0 firmware | İncele |
| 15 | sonicwall | 6bk1602-0aa32-0tp0 | İncele |
| 16 | sonicwall | 6bk1602-0aa42-0tp0 firmware | İncele |
| 17 | sonicwall | 6bk1602-0aa42-0tp0 | İncele |
| 18 | sonicwall | 6bk1602-0aa52-0tp0 firmware | İncele |
| 19 | sonicwall | 6bk1602-0aa52-0tp0 | İncele |
| 20 | oracle | agile engineering data management | İncele |
| 21 | oracle | agile plm mcad connector | İncele |
| 22 | oracle | agile product lifecycle management | İncele |
| 23 | oracle | autovue for agile product lifecycle management | İncele |
| 24 | oracle | banking deposits and lines of credit servicing | İncele |
| 25 | oracle | banking enterprise default management | İncele |
| 26 | oracle | banking enterprise default management | İncele |
| 27 | oracle | banking loans servicing | İncele |
| 28 | oracle | banking party management | İncele |
| 29 | oracle | banking payments | İncele |
| 30 | oracle | banking platform | İncele |
| 31 | oracle | banking platform | İncele |
| 32 | oracle | banking platform | İncele |
| 33 | oracle | banking trade finance | İncele |
| 34 | oracle | banking treasury management | İncele |
| 35 | oracle | business intelligence | İncele |
| 36 | oracle | communications asap | İncele |
| 37 | oracle | communications billing and revenue management | İncele |
| 38 | oracle | communications billing and revenue management | İncele |
| 39 | oracle | communications cloud native core console | İncele |
| 40 | oracle | communications cloud native core network function cloud native environment | İncele |
| 41 | oracle | communications cloud native core network repository function | İncele |
| 42 | oracle | communications cloud native core network repository function | İncele |
| 43 | oracle | communications cloud native core network slice selection function | İncele |
| 44 | oracle | communications cloud native core policy | İncele |
| 45 | oracle | communications cloud native core security edge protection proxy | İncele |
| 46 | oracle | communications cloud native core service communication proxy | İncele |
| 47 | oracle | communications cloud native core unified data repository | İncele |
| 48 | oracle | communications convergence | İncele |
| 49 | oracle | communications convergence | İncele |
| 50 | oracle | communications convergent charging controller | İncele |
| 51 | oracle | communications convergent charging controller | İncele |
| 52 | oracle | communications diameter signaling router | İncele |
| 53 | oracle | communications eagle element management system | İncele |
| 54 | oracle | communications eagle ftp table base retrieval | İncele |
| 55 | oracle | communications element manager | İncele |
| 56 | oracle | communications evolved communications application server | İncele |
| 57 | oracle | communications interactive session recorder | İncele |
| 58 | oracle | communications interactive session recorder | İncele |
| 59 | oracle | communications ip service activator | İncele |
| 60 | oracle | communications messaging server | İncele |
| 61 | oracle | communications network charging and control | İncele |
| 62 | oracle | communications network charging and control | İncele |
| 63 | oracle | communications network integrity | İncele |
| 64 | oracle | communications performance intelligence center | İncele |
| 65 | oracle | communications pricing design center | İncele |
| 66 | oracle | communications pricing design center | İncele |
| 67 | oracle | communications service broker | İncele |
| 68 | oracle | communications services gatekeeper | İncele |
| 69 | oracle | communications session report manager | İncele |
| 70 | oracle | communications session route manager | İncele |
| 71 | oracle | communications unified inventory management | İncele |
| 72 | oracle | communications unified inventory management | İncele |
| 73 | oracle | communications unified inventory management | İncele |
| 74 | oracle | communications user data repository | İncele |
| 75 | oracle | communications webrtc session controller | İncele |
| 76 | oracle | communications webrtc session controller | İncele |
| 77 | oracle | data integrator | İncele |
| 78 | oracle | data integrator | İncele |
| 79 | oracle | e-business suite | İncele |
| 80 | oracle | enterprise manager base platform | İncele |
| 81 | oracle | enterprise manager base platform | İncele |
| 82 | oracle | enterprise manager for peoplesoft | İncele |
| 83 | oracle | enterprise manager for peoplesoft | İncele |
| 84 | oracle | enterprise manager ops center | İncele |
| 85 | oracle | financial services analytical applications infrastructure | İncele |
| 86 | oracle | financial services model management and governance | İncele |
| 87 | oracle | financial services model management and governance | İncele |
| 88 | oracle | financial services model management and governance | İncele |
| 89 | oracle | flexcube universal banking | İncele |
| 90 | oracle | flexcube universal banking | İncele |
| 91 | oracle | flexcube universal banking | İncele |
| 92 | oracle | flexcube universal banking | İncele |
| 93 | oracle | health sciences empirica signal | İncele |
| 94 | oracle | health sciences empirica signal | İncele |
| 95 | oracle | health sciences inform | İncele |
| 96 | oracle | health sciences inform | İncele |
| 97 | oracle | health sciences inform | İncele |
| 98 | oracle | health sciences information manager | İncele |
| 99 | oracle | healthcare data repository | İncele |
| 100 | oracle | healthcare foundation | İncele |
| 101 | oracle | healthcare master person index | İncele |
| 102 | oracle | healthcare translational research | İncele |
| 103 | oracle | healthcare translational research | İncele |
| 104 | oracle | hospitality suite8 | İncele |
| 105 | oracle | hospitality suite8 | İncele |
| 106 | oracle | hospitality token proxy service | İncele |
| 107 | oracle | hyperion bi+ | İncele |
| 108 | oracle | hyperion data relationship management | İncele |
| 109 | oracle | hyperion infrastructure technology | İncele |
| 110 | oracle | hyperion planning | İncele |
| 111 | oracle | hyperion profitability and cost management | İncele |
| 112 | oracle | hyperion tax provision | İncele |
| 113 | oracle | identity management suite | İncele |
| 114 | oracle | identity management suite | İncele |
| 115 | oracle | identity manager connector | İncele |
| 116 | oracle | instantis enterprisetrack | İncele |
| 117 | oracle | instantis enterprisetrack | İncele |
| 118 | oracle | instantis enterprisetrack | İncele |
| 119 | oracle | insurance data gateway | İncele |
| 120 | oracle | insurance insbridge rating and underwriting | İncele |
| 121 | oracle | insurance insbridge rating and underwriting | İncele |
| 122 | oracle | insurance insbridge rating and underwriting | İncele |
| 123 | oracle | jdeveloper | İncele |
| 124 | oracle | managed file transfer | İncele |
| 125 | oracle | managed file transfer | İncele |
| 126 | oracle | management cloud engine | İncele |
| 127 | oracle | mysql enterprise monitor | İncele |
| 128 | oracle | payment interface | İncele |
| 129 | oracle | payment interface | İncele |
| 130 | oracle | peoplesoft enterprise peopletools | İncele |
| 131 | oracle | peoplesoft enterprise peopletools | İncele |
| 132 | oracle | primavera gateway | İncele |
| 133 | oracle | primavera gateway | İncele |
| 134 | oracle | primavera gateway | İncele |
| 135 | oracle | primavera gateway | İncele |
| 136 | oracle | primavera gateway | İncele |
| 137 | oracle | primavera p6 enterprise project portfolio management | İncele |
| 138 | oracle | primavera p6 enterprise project portfolio management | İncele |
| 139 | oracle | primavera p6 enterprise project portfolio management | İncele |
| 140 | oracle | primavera unifier | İncele |
| 141 | oracle | primavera unifier | İncele |
| 142 | oracle | primavera unifier | İncele |
| 143 | oracle | primavera unifier | İncele |
| 144 | oracle | retail back office | İncele |
| 145 | oracle | retail central office | İncele |
| 146 | oracle | retail customer insights | İncele |
| 147 | oracle | retail customer insights | İncele |
| 148 | oracle | retail data extractor for merchandising | İncele |
| 149 | oracle | retail data extractor for merchandising | İncele |
| 150 | oracle | retail eftlink | İncele |
| 151 | oracle | retail eftlink | İncele |
| 152 | oracle | retail eftlink | İncele |
| 153 | oracle | retail eftlink | İncele |
| 154 | oracle | retail eftlink | İncele |
| 155 | oracle | retail eftlink | İncele |
| 156 | oracle | retail financial integration | İncele |
| 157 | oracle | retail financial integration | İncele |
| 158 | oracle | retail financial integration | İncele |
| 159 | oracle | retail financial integration | İncele |
| 160 | oracle | retail financial integration | İncele |
| 161 | oracle | retail integration bus | İncele |
| 162 | oracle | retail integration bus | İncele |
| 163 | oracle | retail integration bus | İncele |
| 164 | oracle | retail integration bus | İncele |
| 165 | oracle | retail integration bus | İncele |
| 166 | oracle | retail integration bus | İncele |
| 167 | oracle | retail integration bus | İncele |
| 168 | oracle | retail invoice matching | İncele |
| 169 | oracle | retail invoice matching | İncele |
| 170 | oracle | retail merchandising system | İncele |
| 171 | oracle | retail merchandising system | İncele |
| 172 | oracle | retail order broker | İncele |
| 173 | oracle | retail order broker | İncele |
| 174 | oracle | retail order broker | İncele |
| 175 | oracle | retail order management system | İncele |
| 176 | oracle | retail point-of-service | İncele |
| 177 | oracle | retail predictive application server | İncele |
| 178 | oracle | retail predictive application server | İncele |
| 179 | oracle | retail predictive application server | İncele |
| 180 | oracle | retail price management | İncele |
| 181 | oracle | retail price management | İncele |
| 182 | oracle | retail price management | İncele |
| 183 | oracle | retail price management | İncele |
| 184 | oracle | retail price management | İncele |
| 185 | oracle | retail returns management | İncele |
| 186 | oracle | retail service backbone | İncele |
| 187 | oracle | retail service backbone | İncele |
| 188 | oracle | retail service backbone | İncele |
| 189 | oracle | retail service backbone | İncele |
| 190 | oracle | retail service backbone | İncele |
| 191 | oracle | retail service backbone | İncele |
| 192 | oracle | retail service backbone | İncele |
| 193 | oracle | retail store inventory management | İncele |
| 194 | oracle | retail store inventory management | İncele |
| 195 | oracle | retail store inventory management | İncele |
| 196 | oracle | retail store inventory management | İncele |
| 197 | oracle | retail store inventory management | İncele |
| 198 | oracle | retail store inventory management | İncele |
| 199 | oracle | siebel ui framework | İncele |
| 200 | oracle | sql developer | İncele |
RED HAT CSAF/VEX — Ürün Etki Kontrolü
Red Hat bu CVE için henüz bir CSAF/VEX etki kaydı yayımlamamış. Bu durum “etkilenmiyor” anlamına gelmez.
SCORING — CVSS Çoklu Kaynak Skoru
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from various sources for each CVE.
| SCORE | VERSION | SEVERITY | VECTOR | SOURCE |
|---|---|---|---|---|
| 5.9 | CVSS V31 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD |
| 4.3 | CVSS V2 | — | AV:N/AC:M/Au:N/C:N/I:N/A:P | NVD |
Yama ve İyileştirme Rehberi (Solution)
Solution & Remediation Advisory
4 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.
Etkilenen ürün ve sürümü yukarıdaki kaynak kanıtlarıyla doğrulayın.
İnternete açık servislerde erişimi kısıtlayın ve ağ segmentasyonu uygulayın.
Kanıtta belirtilen resmî güncellemeyi yalnızca eşleşen ürün ve sürüme uygulayın.
Sunucu günlüklerini ve ağ uçlarını anormal çalıştırma belirtileri için izleyin.
Public exploit ve aktif sömürü durumu
Doğrulanmış exploit istihbaratı
Bu CVE için henüz doğrulanmış public PoC, exploit repository’si veya Metasploit modülü bulunamadı.
Zafiyet Dağılımı ve Saldırı Kalıpları (CWE & CAPEC)
CWE - Common Weakness Enumeration
While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2021-45105 is associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2021-45105 weaknesses.
Saldırı Vektörü ve Erişilebilirlik Karakteristiği
ErişimAğ üzerinden
YetkiGerekmiyor
KullanıcıGerekmiyor
Resmi Kaynaklar ve Danışma Bültenleri
http://www.openwall.com/lists/oss-security/2021/12/19/1nvdhttps://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdfnvdhttps://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdfnvdhttps://logging.apache.org/log4j/2.x/security.htmlvendor-advisoryhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032nvdhttps://security.netapp.com/advisory/ntap-20211218-0001/nvdhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbdnvdhttps://www.debian.org/security/2021/dsa-5024nvdhttps://www.kb.cert.org/vuls/id/930724nvdhttps://www.oracle.com/security-alerts/cpuapr2022.htmlpatch
İlgili Benzer Açıklar
10.0
CVE-2021-44228 Aktif sömürülüyor
Improper input validation in Apache Log4j
S
Yama doğrulandıEPSS %100
10.0
CVE-2015-3306 Aktif sömürülüyor
Improper access control in N/a
N
Geçici çözümEPSS %99
9.8
CVE-2017-5638 Aktif sömürülüyor
struts2: RCE when performing file upload based on Jakarta Multipart parser
A
Geçici çözümEPSS %100
9.8
CVE-2018-11776 Aktif sömürülüyor
struts2: Using specific results and namespaces can result in a remote code execution
A
Geçici çözümEPSS %100
9.8
CVE-2023-46604 Aktif sömürülüyor
activemq-openwire: OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
RH
Kısmi yamaEPSS %100
9.8
CVE-2025-61882 Aktif sömürülüyor
Improper authentication in Oracle Corporation Oracle Concurrent Processing
OC
Geçici çözümEPSS %100
Bu açığı API ile alın
Etkilenen ürünler, sürüm aralıkları, istismar durumu ve yama bilgisi tek istekte; ücretsiz anahtarla.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2021-45105"