Apache Software Foundation Apache Log4J2 vulnerabilities
2 known vulnerabilities affecting apache_software_foundation/apache_log4j2.
Total CVEs
2
CISA KEV
0
Public exploits
1
Exploited in wild
2
Severity breakdown
MEDIUM2
Vulnerabilities
Page 1 of 1
CVE-2021-45105P1MEDIUMCVSS 5.9ExploitedPoCRansomware≥ log4j-core, < 2.17.02021-12-18
CVE-2021-45105 [MEDIUM] CWE-20 CVE-2021-45105: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from u
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
nvd
CVE-2021-44832P1MEDIUMCVSS 6.6ExploitedRansomware≥ log4j-core, < 2.17.12021-12-28
CVE-2021-44832 [MEDIUM] CWE-20 CVE-2021-44832: Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) a
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java
nvd