CVE-2022-23302
published 2022-01-18CVE-2022-23302: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the…
PriorityP272high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
63.84%
99.2th percentile
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
Affected
38 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | log4j | 1.0.1 – 1.2.17 | — |
| debian | apache-log4j1.2 | < apache-log4j1.2 1.2.17-11 (bookworm) | apache-log4j1.2 1.2.17-11 (bookworm) |
| oracle | advanced_supply_chain_planning | — | — |
| oracle | advanced_supply_chain_planning | — | — |
| oracle | business_intelligence | — | — |
| oracle | business_intelligence | — | — |
| oracle | business_intelligence | — | — |
| oracle | business_process_management_suite | — | — |
| oracle | business_process_management_suite | — | — |
| oracle | communications_eagle_ftp_table_base_retrieval | — | — |
| oracle | communications_instant_messaging_server | — | — |
| oracle | communications_messaging_server | — | — |
| oracle | communications_network_integrity | — | — |
| oracle | communications_offline_mediation_controller | < 12.0.0.4.4 | 12.0.0.4.4 |
| oracle | communications_offline_mediation_controller | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | e-business_suite_cloud_manager_and_cloud_backup_module | < 2.2.1.1.1 | 2.2.1.1.1 |
| oracle | e-business_suite_cloud_manager_and_cloud_backup_module | — | — |
| oracle | enterprise_manager_base_platform | — | — |
| oracle | enterprise_manager_base_platform | — | — |
| oracle | financial_services_revenue_management_and_billing_analytics | — | — |
| oracle | financial_services_revenue_management_and_billing_analytics | — | — |
| oracle | financial_services_revenue_management_and_billing_analytics | — | — |
| oracle | healthcare_foundation | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect JNDI lookup requests originating from JMSSink via TopicConnectionFactoryBindingName configuration — monitor for outbound LDAP/JNDI connections from Log4j 1.x JMS-configured applications ↗
- →Flag presence of JMSSink class in deployed log4j 1.x JAR files as an indicator of attack surface exposure ↗
- →Monitor Log4j configuration files for the presence of JMSSink appender definitions, especially those referencing external LDAP endpoints via TopicConnectionFactoryBindingName ↗
- →Alert on deserialization activity from the JMSSink component (org/apache/log4j/net/JMSSink.class) in Log4j 1.x deployments ↗
- ·Vulnerability only triggers when JMSSink is explicitly configured — not exploitable in default Log4j 1.x deployments ↗
- ·Red Hat Satellite using log4j-over-slf4j with Candlepin is not affected because it uses the logback framework for logging ↗
- ·Red Hat Virtualization and OpenShift Container Platform OCP Metering stack ship vulnerable log4j but do not use JMSSink — rated Low impact ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
ghsa7.5HIGH
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
apache-log4j1.2 vulnerabilities
osv·2025-06-23·CVSS 8.8
CVE-2022-23302 [HIGH] apache-log4j1.2 vulnerabilities
apache-log4j1.2 vulnerabilities
It was discovered that several deserialization issues existed within Apache
Log4j. An attacker could possibly use these issues to enable the execution
of arbitrary code. (CVE-2022-23302, CVE-2022-23305, CVE-2022-23307)
OSV
apache-log4j1.2 vulnerabilities
osv·2023-04-05·CVSS 9.8
CVE-2019-17571 [CRITICAL] apache-log4j1.2 vulnerabilities
apache-log4j1.2 vulnerabilities
It was discovered that the SocketServer component of Apache Log4j 1.2
incorrectly handled deserialization. An attacker could possibly use this issue
to execute arbitrary code. This issue only affected Ubuntu 16.04 ESM.
(CVE-2019-17571)
It was discovered that the JMSSink component of Apache Log4j 1.2 incorrectly
handled deserialization. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2022-23302)
It was discovered that Apache Log4j 1.2 incorrectly handled certain SQL
statements. A remote attacker could possibly use this issue to perform an SQL
injection attack and alter the database. This issue was only fixed in Ubuntu
18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-23305)
It was discovered that the Chainsaw component of Apache Log4j 1.
GHSA
Deserialization of Untrusted Data in Log4j 1.x
ghsa·2022-01-21·CVSS 7.5
CVE-2022-23302 [HIGH] CWE-502 Deserialization of Untrusted Data in Log4j 1.x
Deserialization of Untrusted Data in Log4j 1.x
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
OSV
Deserialization of Untrusted Data in Log4j 1.x
osv·2022-01-21·CVSS 7.5
CVE-2022-23302 [HIGH] Deserialization of Untrusted Data in Log4j 1.x
Deserialization of Untrusted Data in Log4j 1.x
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
OSV
CVE-2022-23302: JMSSink in all versions of Log4j 1
osv·2022-01-18·CVSS 7.5
CVE-2022-23302 [HIGH] CVE-2022-23302: JMSSink in all versions of Log4j 1
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
Ubuntu
Apache Log4j vulnerabilities
vendor_ubuntu·2025-06-23·CVSS 8.8
CVE-2022-23302 [HIGH] Apache Log4j vulnerabilities
Title: Apache Log4j vulnerabilities
Summary: Apache Log4j could be made to run programs as your login if it opened a
specially crafted file.
It was discovered that several deserialization issues existed within Apache
Log4j. An attacker could possibly use these issues to enable the execution
of arbitrary code. (CVE-2022-23302, CVE-2022-23305, CVE-2022-23307)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Apache Log4j vulnerabilities
vendor_ubuntu·2023-04-05·CVSS 9.8
CVE-2019-17571 [CRITICAL] Apache Log4j vulnerabilities
Title: Apache Log4j vulnerabilities
Summary: Several security issues were fixed in Apache Log4j.
It was discovered that the SocketServer component of Apache Log4j 1.2
incorrectly handled deserialization. An attacker could possibly use this issue
to execute arbitrary code. This issue only affected Ubuntu 16.04 ESM.
(CVE-2019-17571)
It was discovered that the JMSSink component of Apache Log4j 1.2 incorrectly
handled deserialization. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2022-23302)
It was discovered that Apache Log4j 1.2 incorrectly handled certain SQL
statements. A remote attacker could possibly use this issue to perform an SQL
injection attack and alter the database. This issue was only fixed in Ubuntu
18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-23305)
Red Hat
log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink
vendor_redhat·2022-01-18·CVSS 7.5
CVE-2022-23302 [HIGH] CWE-502 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink
log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
A flaw was found in the Java
Debian
CVE-2022-23302: apache-log4j1.2 - JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrust...
vendor_debian·2022·CVSS 7.5
CVE-2022-23302 [HIGH] CVE-2022-23302: apache-log4j1.2 - JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrust...
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
Scope: local
bookworm: resolved (fixed in 1.2.17-11)
bullseye: resolved (fixed in 1.2.17-10+deb11u1)
forky: resolved (
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Over 30% of Log4J apps use a vulnerable version of the library
blogs_bleepingcomputer·2023-12-10·CVSS 10.0
CVE-2021-44228 [CRITICAL] Over 30% of Log4J apps use a vulnerable version of the library
## Over 30% of Log4J apps use a vulnerable version of the library
## Bill Toulas
Roughly 38% of applications using the Apache Log4j library are using a version vulnerable to security issues, including Log4Shell, a critical vulnerability identified as CVE-2021-44228 that carries the maximum severity rating, despite patches being available for more than two years.
Log4Shell is an unauthenticated remote code execution (RCE) flaw that allows taking complete control over systems with Log4j 2.0-beta9 and up to 2.15.0.
The flaw was discovered as an actively exploited zero-day on December 10, 2021, and its widespread impact, ease of exploitation, and massive security implications acted as an open invitation to threat actors.
The circumstance prompted an extensive campaign to notify affected p
Tenable
Oracle July 2022 Critical Patch Update Addresses 188 CVEs
blogs_tenable·2022-07-20
Oracle July 2022 Critical Patch Update Addresses 188 CVEs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
arXiv
Attack Techniques and Threat Identification for Vulnerabilities
arxiv_fulltext·2022-06-22
Attack Techniques and Threat Identification for Vulnerabilities
Attack Techniques and Threat Identification for Vulnerabilities
Constantin Adam
Muhammed Fatih Bulut
Daby Sow
cmadam, mfbulut, [email protected]
IBM T.J. Watson Research Center
Yorktown Heights
NY
USA
Steven Ocepek
Chris Bedell
steve.ocepek, [email protected]
IBM Security X-Force Red
USA
Lilian Ngweta
[email protected]
Rensselaer Polytechnic Institute
Troy
NY
USA
Adam and Bulut, et al.
## Abstract
Modern organizations struggle with what is often considered an insurmountable number of vulnerabilities that are discovered and reported by their network and application vulnerability scanners. Therefore, prioritization and focus become critical, to spend their limited time on the highest risk vulnerabilities. In doing this, it is important for these organizations not only to
Bugzilla
CVE-2022-23302 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink
bugzilla·2022-01-18·CVSS 7.5
CVE-2022-23302 [HIGH] CVE-2022-23302 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink
CVE-2022-23302 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104.
Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default.
References:
https://www.openwall.com/lists/oss-security/2022/01/18/3
Discussion:
Marking /services "notaffected" per previous analysis/remediation.
---
This i
http://www.openwall.com/lists/oss-security/2022/01/18/3https://lists.apache.org/thread/bsr3l5qz4g0myrjhy9h67bcxodpkwj4whttps://logging.apache.org/log4j/1.2/index.htmlhttps://security.netapp.com/advisory/ntap-20220217-0006/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttp://www.openwall.com/lists/oss-security/2022/01/18/3https://lists.apache.org/thread/bsr3l5qz4g0myrjhy9h67bcxodpkwj4whttps://logging.apache.org/log4j/1.2/index.htmlhttps://security.netapp.com/advisory/ntap-20220217-0006/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://www.vicarius.io/vsociety/posts/cve-2022-23302-detect-log4j-1217-vulnerabilityhttps://www.vicarius.io/vsociety/posts/cve-2022-23302-mitigate-log4j-1217-vulnerability
2022-01-18
Published