⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2023-05-22.
CVE-2021-45046
Severity
9.0CRITICAL
EPSS
94.3%
top 0.04%
CISA KEV
KEVRansomware
Added 2023-05-01
Due 2023-05-22
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedDec 14
KEV addedMay 1
KEV dueMay 22
CISA Required Action: Apply updates per vendor instructions.
Description
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execu…
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 2.2 | Impact: 6.0
Affected Packages33 packages
Also affects: Debian Linux 10.0, 11.0, Fedora 34, 35
Patches
🔴Vulnerability Details
5OSV
▶
CVEList▶
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack↗2021-12-14
💥Exploits & PoCs
2Nuclei▶
Apache Log4j2 - Remote Code Injection
Nuclei▶
Apache Log4j2 - Remote Code Injection