CVE-2021-44228

10.0

CRITICAL

Apache Log4j2 Remote Code Execution Vulnerability - [Actively Exploited]

Description

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

INFO

Published Date :

Dec. 10, 2021, 10:15 a.m.

Last Modified :

July 24, 2024, 5:08 p.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

6.0

Exploitability Score :

3.9

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Dec 24, 2021

Alert Date: Dec 10, 2021 | 1006 days ago

Description :

Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

Required Action :

For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

Public PoC/Exploit Available at Github

CVE-2021-44228 has a 1346 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2021-44228 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Cisco	finesse
2	Cisco	webex_meetings_server
3	Cisco	fxos
4	Cisco	enterprise_chat_and_email
5	Cisco	dna_center
6	Cisco	common_services_platform_collector
7	Cisco	mobility_services_engine
8	Cisco	unified_communications_manager_im_and_presence_service
9	Cisco	unified_contact_center_express
10	Cisco	identity_services_engine
11	Cisco	firepower_threat_defense
12	Cisco	unified_communications_manager
13	Cisco	emergency_responder
14	Cisco	unity_connection
15	Cisco	unified_intelligence_center
16	Cisco	network_assurance_engine
17	Cisco	unified_computing_system
18	Cisco	data_center_network_manager
19	Cisco	packaged_contact_center_enterprise
20	Cisco	network_services_orchestrator
21	Cisco	integrated_management_controller_supervisor
22	Cisco	ucs_director
23	Cisco	video_surveillance_manager
24	Cisco	cx_cloud_agent
25	Cisco	unified_contact_center_enterprise
26	Cisco	unified_intelligence_center
27	Cisco	prime_service_catalog
28	Cisco	unified_customer_voice_portal
29	Cisco	sd-wan_vmanage
30	Cisco	evolved_programmable_network_manager
31	Cisco	dna_spaces\
32	Cisco	video_surveillance_operations_manager
33	Cisco	unified_communications_manager_im_\&_presence_service
34	Cisco	ucs_central_software
35	Cisco	virtualized_voice_browser
36	Cisco	nexus_dashboard
37	Cisco	business_process_automation
38	Cisco	intersight_virtual_appliance
39	Cisco	connected_mobile_experiences
40	Cisco	cloudcenter
41	Cisco	unified_contact_center_management_portal
42	Cisco	fog_director
43	Cisco	advanced_malware_protection_virtual_private_cloud_appliance
44	Cisco	automated_subsea_tuning
45	Cisco	broadworks
46	Cisco	cloud_connect
47	Cisco	cloudcenter_cost_optimizer
48	Cisco	cloudcenter_suite_admin
49	Cisco	cloudcenter_workload_manager
50	Cisco	contact_center_domain_manager
51	Cisco	contact_center_management_portal
52	Cisco	crosswork_data_gateway
53	Cisco	crosswork_network_controller
54	Cisco	crosswork_optimization_engine
55	Cisco	crosswork_platform_infrastructure
56	Cisco	crosswork_zero_touch_provisioning
57	Cisco	customer_experience_cloud_agent
58	Cisco	cyber_vision_sensor_management_extension
59	Cisco	iot_operations_dashboard
60	Cisco	nexus_insights
61	Cisco	optical_network_controller
62	Cisco	paging_server
63	Cisco	smart_phy
64	Cisco	ucs_central
65	Cisco	virtual_topology_system
66	Cisco	virtualized_infrastructure_manager
67	Cisco	wan_automation_engine
68	Cisco	workload_optimization_manager
69	Cisco	unified_sip_proxy
70	Cisco	unified_workforce_optimization
71	Cisco	cloudcenter_suite
72	Cisco	connected_analytics_for_network_deployment
73	Cisco	crosswork_network_automation
74	Cisco	cyber_vision
75	Cisco	dna_spaces
76	Cisco	dna_spaces_connector
77	Cisco	network_dashboard_fabric_controller
78	Cisco	network_insights_for_data_center
79	Cisco	unified_sip_proxy
80	Cisco	unified_workforce_optimization
81	Cisco	firepower_1010
82	Cisco	firepower_1120
83	Cisco	firepower_1140
84	Cisco	firepower_1150
85	Cisco	firepower_2110
86	Cisco	firepower_2120
87	Cisco	firepower_2130
88	Cisco	firepower_2140
89	Cisco	firepower_4110
90	Cisco	firepower_4112
91	Cisco	firepower_4115
92	Cisco	firepower_4120
93	Cisco	firepower_4125
94	Cisco	firepower_4140
95	Cisco	firepower_4145
96	Cisco	firepower_4150
97	Cisco	firepower_9300
1	Siemens	logo\!_soft_comfort
2	Siemens	spectrum_power_4
3	Siemens	spectrum_power_7
4	Siemens	teamcenter
5	Siemens	sipass_integrated
6	Siemens	mendix
7	Siemens	comos
8	Siemens	siveillance_control_pro
9	Siemens	gma-manager
10	Siemens	operation_scheduler
11	Siemens	industrial_edge_management
12	Siemens	opcenter_intelligence
13	Siemens	sppa-t3000_ses3000_firmware
14	Siemens	captial
15	Siemens	desigo_cc_advanced_reports
16	Siemens	desigo_cc_info_center
17	Siemens	e-car_operation_center
18	Siemens	energy_engage
19	Siemens	energyip
20	Siemens	energyip_prepay
21	Siemens	head-end_system_universal_device_integration_system
22	Siemens	industrial_edge_management_hub
23	Siemens	mindsphere
24	Siemens	navigator
25	Siemens	nx
26	Siemens	sentron_powermanager
27	Siemens	siguard_dsa
28	Siemens	siveillance_command
29	Siemens	siveillance_identity
30	Siemens	siveillance_vantage
31	Siemens	siveillance_viewpoint
32	Siemens	solid_edge_cam_pro
33	Siemens	solid_edge_harness_design
34	Siemens	vesys
35	Siemens	xpedition_enterprise
36	Siemens	xpedition_package_integrator
37	Siemens	sppa-t3000_ses3000
1	Intel	data_center_manager
2	Intel	audio_development_kit
3	Intel	computer_vision_annotation_tool
4	Intel	genomics_kernel_library
5	Intel	oneapi_sample_browser
6	Intel	secure_device_onboard
7	Intel	sensor_solution_firmware_development_kit
8	Intel	system_debugger
9	Intel	system_studio
1	Netapp	active_iq_unified_manager
2	Netapp	oncommand_insight
3	Netapp	snapcenter
4	Netapp	cloud_insights
5	Netapp	ontap_tools
6	Netapp	cloud_secure_agent
7	Netapp	cloud_manager
1	Snowsoftware	snow_commander
2	Snowsoftware	vm_access_proxy
1	Bentley	synchro
2	Bentley	synchro_4d
1	Fedoraproject	fedora
1	Debian	debian_linux
1	Apple	xcode
1	Apache	log4j
1	Sonicwall	email_security
1	Percussion	rhythmyx

: Total Affected Vendor : 12 | Products : 160

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2021-44228.

URL	Resource
http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html	Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html	Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html	Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html	Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html	Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html	Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html	Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html	Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html	Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html	Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html	Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html	Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html	Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html	Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html	Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html	Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2022/Dec/2	Exploit Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jul/11	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Mar/23	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/10/1	Mailing List Mitigation Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/10/2	Mailing List Mitigation Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/10/3	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/13/1	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/13/2	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/14/4	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/15/3	Mailing List Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf	Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf	Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf	Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf	Third Party Advisory
https://github.com/cisagov/log4j-affected-db	Third Party Advisory
https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md	Broken Link Product US Government Resource
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228	Exploit Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/	Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/	Release Notes
https://logging.apache.org/log4j/2.x/security.html	Release Notes Vendor Advisory
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/	Patch Third Party Advisory Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032	Third Party Advisory
https://security.netapp.com/advisory/ntap-20211210-0007/	Third Party Advisory
https://support.apple.com/kb/HT213189	Third Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd	Third Party Advisory
https://twitter.com/kurtseifried/status/1469345530182455296	Broken Link Exploit Third Party Advisory
https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001	Third Party Advisory
https://www.debian.org/security/2021/dsa-5020	Mailing List Third Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html	Third Party Advisory
https://www.kb.cert.org/vuls/id/930724	Third Party Advisory US Government Resource
https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html	Exploit Third Party Advisory
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html	Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html	Patch Third Party Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

safeer-accuknox/log4j-shell-poc

Log4J exploit CVE-2021-44228

Dockerfile

Updated: 14 hours, 7 minutes ago

0 stars 0 fork 0 watcher

Born at : Sept. 11, 2024, 5:06 a.m. This repo has been linked 1 different CVEs too.

OtisSymbos/CVE-2021-44228-Log4Shell-

None

Shell

Updated: 22 hours, 26 minutes ago

0 stars 0 fork 0 watcher

Born at : Sept. 11, 2024, 1:13 a.m. This repo has been linked 1 different CVEs too.

ongamse/dv-log4j

None

Java HTML

Updated: 23 hours, 58 minutes ago

0 stars 0 fork 0 watcher

Born at : Sept. 10, 2024, 11:34 p.m. This repo has been linked 1 different CVEs too.

20MH1A04H9/Cyber-Security-Projects

The global cybersecurity market is expected to record a compound annual growth rate of 13.4% by 2029.

Updated: 2 days, 21 hours ago

0 stars 0 fork 0 watcher

Born at : Sept. 8, 2024, 10:20 p.m. This repo has been linked 7 different CVEs too.

ongamse/dv-log4j-app

None

Java HTML

Updated: 5 days, 10 hours ago

0 stars 0 fork 0 watcher

Born at : Sept. 5, 2024, 10:09 p.m. This repo has been linked 1 different CVEs too.

harshit-kochar/Damn-vulnerable-sca

None

Java JavaScript HTML CSS

Updated: 6 days, 10 hours ago

0 stars 0 fork 0 watcher

Born at : Sept. 5, 2024, 1:09 p.m. This repo has been linked 7 different CVEs too.

Deep-Bagchi/awesome-burp-extensions

None

Updated: 1 week, 1 day ago

0 stars 0 fork 0 watcher

Born at : Sept. 3, 2024, 3:34 p.m. This repo has been linked 2 different CVEs too.

Ramsy4754/GoExporter

Third party message exporter made in golang

Batchfile Go

Updated: 1 week, 1 day ago

0 stars 0 fork 0 watcher

Born at : Sept. 3, 2024, 7:45 a.m. This repo has been linked 2 different CVEs too.

AllenJustine/Automating-Log4j-Exploit-using-Python

None

Dockerfile Python Java Shell HTML Batchfile C C++ CSS Roff

Updated: 1 week, 1 day ago

0 stars 0 fork 0 watcher

Born at : Aug. 28, 2024, 3 p.m. This repo has been linked 1 different CVEs too.

hunthack3r/road

None

Updated: 2 weeks ago

0 stars 0 fork 0 watcher

Born at : Aug. 28, 2024, 2:22 p.m. This repo has been linked 1 different CVEs too.

dirtycoins/ShodanTelegramBot

ShodanTelegramBot is a Telegram bot integrated with the Shodan API, allowing users to perform Shodan searches and view results directly within Telegram.

Python

Updated: 1 week, 5 days ago

0 stars 0 fork 0 watcher

Born at : Aug. 17, 2024, 5:34 p.m. This repo has been linked 1 different CVEs too.

DXHM/Auto_Integrate_POCs

Base on actions to integrate some POCs every day.

Python

Updated: 4 days, 11 hours ago

1 stars 0 fork 0 watcher

Born at : Aug. 14, 2024, 5:14 a.m. This repo has been linked 5 different CVEs too.

AllenJustine/Exploiting-the-Log4j-Vulnerability-A-Step-by-Step-Guide

None

Updated: 3 weeks ago

0 stars 0 fork 0 watcher

Born at : Aug. 3, 2024, 1:48 a.m. This repo has been linked 1 different CVEs too.

carkn/minecraft-infrastructure

None

Dockerfile HCL

Updated: 1 month, 1 week ago

0 stars 0 fork 0 watcher

Born at : Aug. 2, 2024, 6:22 a.m. This repo has been linked 1 different CVEs too.

asd58584388/CVE-2021-44228

CVE-2021-44228 vulnerability study

Java

Updated: 1 month, 2 weeks ago

0 stars 0 fork 0 watcher

Born at : July 26, 2024, 7:59 p.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2021-44228 vulnerability anywhere in the article.

The Cyber Express

Microsoft September 2024 Patch Tuesday: Addressing 79 New Vulnerabilities and Product Updates

The second Tuesday of September has once again proven to be a significant date for cybersecurity with Microsoft’s latest Patch Tuesday update. This month’s release is dominated by a daunting array of ...

Published Date: Sep 11, 2024 (14 hours, 31 minutes ago)

CVE-2024-43491 CVE-2024-43464 CVE-2024-38226 CVE-2024-38217 CVE-2024-38119 CVE-2024-38018 CVE-2024-38014 CVE-2024-7591 CVE-2024-21893 CVE-2024-21887 ...+3 more CVE

The Cyber Express

Don’t Delay: Patch LoadMaster Now to Avoid Exploitation

A security vulnerability, identified as CVE-2024-7591, has been disclosed affecting all versions of LoadMaster and the LoadMaster Multi-Tenant (MT) hypervisor. The LoadMaster vulnerability is critical ...

Published Date: Sep 10, 2024 (1 day, 13 hours ago)

CVE-2024-7591 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805 CVE-2021-44228 CVE-2017-11882

The Cyber Express

Critical Vulnerabilities Disclosed in IBM webMethods Integration Server

IBM has revealed several severe vulnerabilities within its webMethods Integration Server, a platform widely utilized for integration and API management. These IBM webMethods Integration vulnerabilitie ...

Published Date: Sep 09, 2024 (2 days, 17 hours ago)

CVE-2024-45076 CVE-2024-45075 CVE-2024-45074 CVE-2024-45195 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805 CVE-2021-44228 CVE-2017-11882

The Cyber Express

Critical RCE Vulnerability Patched in Apache OFBiz (CVE-2024-45195)

Popular open-source enterprise Resource Planning (ERP) system, Apache OFBiz, recently discovered harboring a critical Remote Code Execution (RCE) vulnerability. Tracked as CVE-2024-45195, the Apache O ...

Published Date: Sep 06, 2024 (5 days, 13 hours ago)

CVE-2024-45195 CVE-2024-38856 CVE-2024-36104 CVE-2024-32113 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805 CVE-2021-44228 CVE-2017-11882

The Cyber Express

High-Risk Vulnerabilities Discovered in Zyxel Firewalls: What You Need to Know

Zyxel Networks has recently issued a critical alert regarding several high-risk vulnerabilities affecting their firewall products. This warning comes as part of a broader security advisory that highli ...

Published Date: Sep 04, 2024 (1 week ago)

CVE-2024-42061 CVE-2024-7203 CVE-2024-6343 CVE-2024-42060 CVE-2024-42059 CVE-2024-42058 CVE-2024-42057 CVE-2024-4885 CVE-2024-21893 CVE-2024-21887 ...+3 more CVE

The Cyber Express

CERT-IN Warns About Critical Vulnerabilities in Palo Alto Networks Applications

The Indian Computer Emergency Response Team (CERT-IN) has issued advisories regarding critical vulnerabilities affecting several Palo Alto Networks applications. These vulnerabilities could allow atta ...

Published Date: Sep 03, 2024 (1 week, 1 day ago)

CVE-2024-5916 CVE-2024-5915 CVE-2024-5914 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805 CVE-2021-44228 CVE-2017-11882

The Cyber Express

Canonical Addresses Critical Linux Kernel AWS Vulnerabilities with New Patches

Canonical has rolled out essential security updates for Ubuntu, addressing multiple Linux kernel vulnerabilities that also impact Amazon Web Services (AWS). These issues, which involve race conditions ...

Published Date: Sep 03, 2024 (1 week, 1 day ago)

CVE-2024-39292 CVE-2023-52806 CVE-2023-52760 CVE-2024-35835 CVE-2024-24860 CVE-2024-21893 CVE-2024-22099 CVE-2024-21887 CVE-2023-46805 CVE-2021-44228 ...+1 more CVE

The Cyber Express

Cyberattack Hits Shoshone-Bannock Tribes: Key Services Unaffected, Recovery in Progress

The Shoshone-Bannock Tribes have confirmed a cybersecurity incident that disrupted their operations on the Fort Hall Reservation in Idaho. The Shoshone-Bannock Tribes cyberattack, reported on August 2 ...

Published Date: Sep 03, 2024 (1 week, 1 day ago)

CVE-2024-4885 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805 CVE-2021-44228 CVE-2017-11882

The Cyber Express

North Korean Hackers Exploited Chromium Zero-Day to Deploy Rootkit

In a recent attack, a North Korean threat actor leveraged a zero-day vulnerability in Google’s Chromium browser to deploy the FudModule rootkit, targeting cryptocurrency firms for financial gain. Micr ...

Published Date: Aug 30, 2024 (1 week, 5 days ago)

CVE-2024-7971 CVE-2024-38106 CVE-2024-4885 CVE-2024-21338 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805 CVE-2021-44228 CVE-2017-11882

The Cyber Express

Cyberespionage Threat: APT-C-60 Targets East Asia with SpyGlace

A sophisticated cyberespionage campaign targeting East Asian countries has been uncovered, with the APT-C-60 group exploiting a zero-day vulnerability in WPS Office to deploy the notorious SpyGlace ba ...

Published Date: Aug 30, 2024 (1 week, 5 days ago)

CVE-2024-7263 CVE-2024-4885 CVE-2024-4167 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805 CVE-2021-44228 CVE-2017-11882

The Cyber Express

Critical Vulnerabilities in Progress Software’s WhatsUp Gold Expose Systems to Severe Risks

Recent security findings reveal that Progress Software’s WhatsUp Gold, a prominent enterprise network monitoring and management solution, harbors significant vulnerabilities that could lead to full sy ...

Published Date: Aug 30, 2024 (1 week, 5 days ago)

CVE-2024-4885 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805 CVE-2021-44228 CVE-2017-11882

The Cyber Express

Massive Mirai Botnet Exploited Zero-Day Vulnerability in AVTECH Cameras

Researchers have discovered a botnet campaign that is exploiting several vulnerabilities, including a zero-day vulnerability (CVE-2024-7029) in AVTECH closed-circuit television (CCTV) cameras that cou ...

Published Date: Aug 30, 2024 (1 week, 5 days ago)

CVE-2024-7029 CVE-2024-4885 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805 CVE-2021-44228 CVE-2017-17215 CVE-2017-11882 CVE-2014-8361

The Cyber Express

Russian State Hackers Using Exploits ‘Strikingly Similar’ to Spyware Vendors NSO and Intellexa

Google has identified a connection between Russian state hackers and exploits that bear an “identical or strikingly similar” resemblance to those created by spyware companies NSO Group and Intellexa, ...

Published Date: Aug 29, 2024 (1 week, 6 days ago)

CVE-2024-4885 CVE-2024-5274 CVE-2024-4671 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805 CVE-2023-41993 CVE-2021-44228 CVE-2017-11882

The Cyber Express

Iranian State Hackers Act as Access Brokers for Ransomware Gangs, Target U.S. and Allies’ Critical Infrastructure

A shadowy group of Iranian cyber actors is acting as access brokers for ransomware gangs and collaborating with affiliates to target the U.S. and its allies, exploiting vulnerabilities across sectors ...

Published Date: Aug 28, 2024 (2 weeks ago)

CVE-2024-4885 CVE-2024-3400 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805 CVE-2023-3519 CVE-2022-1388 CVE-2021-44228 CVE-2019-19781 CVE-2017-11882

The Cyber Express

Critical Apache OFBiz Vulnerability CVE-2024-38856 Identified and Actively Exploited

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged a security vulnerability affecting Apache OFBiz, the open-source enterprise resource planning (ERP) system. This Apache OFB ...

Published Date: Aug 28, 2024 (2 weeks ago)

CVE-2024-38856 CVE-2024-4885 CVE-2024-36104 CVE-2024-32113 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805 CVE-2021-44228 CVE-2017-11882

The Cyber Express

Critical WPML Plugin Flaw Exposes Millions of WordPress Sites to Remote Code Execution

A critical vulnerability has been discovered in the WPML (WordPress Multilingual) plugin, exposing millions of WordPress websites to potential Remote Code Execution (RCE) attacks. This WPML Plugin Fla ...

Published Date: Aug 28, 2024 (2 weeks ago)

CVE-2024-6386 CVE-2024-4885 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805 CVE-2021-44228 CVE-2017-11882

The Cyber Express

Versa Director Zero-Day Attack: A Non-Critical Vulnerability with Low Exposure Can Still Be Trouble

A zero-day vulnerability in Versa Director servers is proof that a vulnerability doesn’t require a critical severity rating and thousands of exposures to do significant damage. CVE-2024-39717, announc ...

Published Date: Aug 27, 2024 (2 weeks, 1 day ago)

CVE-2024-39717 CVE-2024-4885 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805 CVE-2021-44228 CVE-2017-11882

The Cyber Express

Critical Chrome Zero-Day Vulnerability (CVE-2024-7965) Requires Immediate User Action

Google recently addressed a critical zero-day vulnerability in its Chrome browser, identified as CVE-2024-7965. This high-severity flaw, affecting versions of Chrome prior to 128.0.6613.84, has been a ...

Published Date: Aug 27, 2024 (2 weeks, 1 day ago)

CVE-2024-7971 CVE-2024-7965 CVE-2024-4885 CVE-2024-5274 CVE-2024-4947 CVE-2024-4671 CVE-2024-3159 CVE-2024-2887 CVE-2024-2886 CVE-2024-21893 ...+5 more CVE

The Hacker News

New Malware PG_MEM Targets PostgreSQL Databases for Crypto Mining

Database Security / Cryptocurrency Cybersecurity researchers have unpacked a new malware strain dubbed PG_MEM that's designed to mine cryptocurrency after brute-forcing their way into PostgreSQL datab ...

Published Date: Aug 22, 2024 (2 weeks, 6 days ago)

CVE-2024-7965 CVE-2021-44228

Cybersecurity News

Log4j Exploited Again: New Campaign Targets Vulnerable Systems with Crypto-Mining and Backdoors

Despite its discovery over two years ago, the Log4j vulnerability, known as Log4Shell (CVE-2021-44228), continues to pose a significant threat to global cybersecurity. A recent report from Datadog Sec ...

Published Date: Aug 22, 2024 (2 weeks, 6 days ago)

CVE-2024-6386 CVE-2024-38193 CVE-2024-38856 CVE-2024-38529 CVE-2024-37906 CVE-2024-0646 CVE-2021-44228

The Hacker News

Anatomy of an Attack

In today's rapidly evolving cyber threat landscape, organizations face increasingly sophisticated attacks targeting their applications. Understanding these threats and the technologies designed to com ...

Published Date: Aug 20, 2024 (3 weeks, 1 day ago)

CVE-2024-7965 CVE-2021-44228

The Cyber Express

Critical Remote Code Execution Vulnerability Addressed in GiveWP Plugin

The GiveWP plugin, a widely used donation and fundraising tool for WordPress, has recently undergone a crucial update to address a severe security flaw. This GiveWP vulnerability, discovered by the re ...

Published Date: Aug 20, 2024 (3 weeks, 1 day ago)

CVE-2024-5932 CVE-2024-4885 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805 CVE-2021-44228 CVE-2017-11882

AttackIQ

Emulating the Politically Motivated North Korean Adversary Andariel – Part 2

On December 11, 2023, Cisco Talos reported the discovery of an activity led by Andariel, a North Korean state-sponsored known to be a subgroup of the notorious Lazarus group, which employed three new ...

Published Date: Jul 31, 2024 (1 month, 1 week ago)

CVE-2021-44228

huntress.com

Critical RCE Vulnerability Updates (log4j - CVE-2021-44228) | Huntress

Our team is investigating CVE-2021-44228, a critical vulnerability that’s affecting a Java logging package log4j which is used in a significant amount of software, including Apache, Apple iCloud, Stea ...

Published Date: Jul 21, 2024 (1 month, 3 weeks ago)

CVE-2021-44832 CVE-2021-45105 CVE-2021-44228

The Cloudflare Blog

Application Security report: 2024 update

2024-07-1111 min readThis post is also available in 简体中文, 繁體中文, 日本語, 한국어, Deutsch, Español and Français. Over the last twelve months, the Internet security landscape has changed dramatically. Geopolit ...

Published Date: Jul 11, 2024 (2 months ago)

CVE-2024-27198 CVE-2023-50164 CVE-2023-35082 CVE-2023-38203 CVE-2023-29298 CVE-2023-26360 CVE-2022-33891 CVE-2021-44228

The Cloudflare Blog

RADIUS/UDP vulnerable to improved MD5 collision attack

2024-07-0917 min readThe MD5 cryptographic hash function was first broken in 2004, when researchers demonstrated the first MD5 collision, namely two different messages X1 and X2 where MD5(X1) = MD5 (X ...

Published Date: Jul 09, 2024 (2 months ago)

CVE-2024-3596 CVE-2024-21887 CVE-2023-46805 CVE-2023-38831 CVE-2021-44228

Google Cloud

Poll Vaulting: Cyber Threats to Global Elections

Written by: Kelli Vanderlee, Jamie Collier Executive Summary The election cybersecurity landscape globally is characterized by a diversity of targets, tactics, and threats. Elections attract threat ac ...

Published Date: Apr 25, 2024 (4 months, 2 weeks ago)

CVE-2021-44228

curatedintel.org

Nightmare Before Christmas - Curated Intel's Response To Log4Shell

Written by @BushidoToken, @TrevorGiffen | Edited by @SteveD3On late Thursday, 9 December, security researchers warned of a critical vulnerability with wide ramifications. With a CVSS score of 10.0 (Cr ...

Published Date: Dec 21, 2021 (2 years, 8 months ago)

CVE-2021-45105 CVE-2021-45046 CVE-2021-4104 CVE-2021-44228

The following table lists the changes that have been made to the CVE-2021-44228 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

Modified Analysis by [email protected]

Jul. 24, 2024

Action	Type	Old Value	New Value
Changed	Reference Type	http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html Third Party Advisory, VDB Entry	http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html Exploit, Third Party Advisory, VDB Entry
Changed	Reference Type	http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html Third Party Advisory, VDB Entry	http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html Exploit, Third Party Advisory, VDB Entry
Changed	Reference Type	http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html Third Party Advisory, VDB Entry	http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
Changed	Reference Type	http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html Third Party Advisory, VDB Entry	http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
Changed	Reference Type	http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html No Types Assigned	http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html Third Party Advisory, VDB Entry
Changed	Reference Type	https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md Product, US Government Resource	https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md Broken Link, Product, US Government Resource
Changed	Reference Type	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/ No Types Assigned	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/ Release Notes
Changed	Reference Type	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/ No Types Assigned	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/ Release Notes
Changed	Reference Type	https://security.netapp.com/advisory/ntap-20211210-0007/ Vendor Advisory	https://security.netapp.com/advisory/ntap-20211210-0007/ Third Party Advisory
Changed	Reference Type	https://twitter.com/kurtseifried/status/1469345530182455296 Exploit, Third Party Advisory	https://twitter.com/kurtseifried/status/1469345530182455296 Broken Link, Exploit, Third Party Advisory
Changed	Reference Type	https://www.debian.org/security/2021/dsa-5020 Third Party Advisory	https://www.debian.org/security/2021/dsa-5020 Mailing List, Third Party Advisory
Changed	CPE Configuration	AND OR cpe:2.3:h:siemens:sppa-t3000_ses3000:-:::::::* OR cpe:2.3:o:siemens:sppa-t3000_ses3000_firmware::::::::*	AND OR cpe:2.3:o:siemens:sppa-t3000_ses3000_firmware::::::::* OR cpe:2.3:h:siemens:sppa-t3000_ses3000:-:::::::*
Added	CPE Configuration		OR cpe:2.3:a:apple:xcode::::::::* versions up to (excluding) 13.3

CVE Modified by [email protected]

May. 14, 2024

Action Type Old Value New Value

CVE Modified by [email protected]

Nov. 07, 2023

Action	Type	Old Value	New Value
Added	Reference		Apache Software Foundation https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/ [No types assigned]
Added	Reference		Apache Software Foundation https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/ [No types assigned]
Removed	Reference	Apache Software Foundation https://lists.fedoraproject.org/archives/list/[email protected]/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/
Removed	Reference	Apache Software Foundation https://lists.fedoraproject.org/archives/list/[email protected]/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/

CVE Modified by [email protected]

Apr. 03, 2023

Action Type Old Value New Value

Added Reference http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html [No Types Assigned]

Modified Analysis by [email protected]

Feb. 06, 2023

Action	Type	Old Value	New Value
Changed	Reference Type	http://seclists.org/fulldisclosure/2022/Dec/2 No Types Assigned	http://seclists.org/fulldisclosure/2022/Dec/2 Exploit, Mailing List, Third Party Advisory
Changed	CPE Configuration	OR cpe:2.3:a:intel:audio_development_kit:-::::::: cpe:2.3:a:intel:computer_vision_annotation_tool:-::::::: cpe:2.3:a:intel:data_center_manager:-::::::: cpe:2.3:a:intel:genomics_kernel_library:-::::::: cpe:2.3:a:intel:oneapi_sample_browser:-:::::eclipse::* cpe:2.3:a:intel:secure_device_onboard:-::::::: cpe:2.3:a:intel:sensor_solution_firmware_development_kit:-::::::: cpe:2.3:a:intel:system_debugger:-::::::: cpe:2.3:a:intel:system_studio:-:::::::	OR cpe:2.3:a:intel:audio_development_kit:-::::::: cpe:2.3:a:intel:computer_vision_annotation_tool:-::::::: cpe:2.3:a:intel:data_center_manager::::::::* versions up to (excluding) 5.1 cpe:2.3:a:intel:genomics_kernel_library:-::::::: cpe:2.3:a:intel:oneapi_sample_browser:-:::::eclipse::* cpe:2.3:a:intel:secure_device_onboard:-::::::: cpe:2.3:a:intel:sensor_solution_firmware_development_kit:-::::::: cpe:2.3:a:intel:system_debugger:-::::::: cpe:2.3:a:intel:system_studio:-:::::::

CVE Modified by [email protected]

Dec. 09, 2022

Action Type Old Value New Value

Added Reference http://seclists.org/fulldisclosure/2022/Dec/2 [No Types Assigned]
Reanalysis by [email protected]

Aug. 17, 2022

Action Type Old Value New Value

Added CPE Configuration OR *cpe:2.3:a:percussion:rhythmyx:*:*:*:*:*:*:*:* versions up to (including) 7.3.2

Action	Type	Old Value	New Value
Added	Reference		http://seclists.org/fulldisclosure/2022/Dec/2 [No Types Assigned]

Action	Type	Old Value	New Value
Added	CPE Configuration		OR cpe:2.3:a:percussion:rhythmyx::::::::* versions up to (including) 7.3.2

Modified Analysis by [email protected]

Aug. 09, 2022

Action	Type	Old Value	New Value
Changed	Reference Type	http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html No Types Assigned	http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html Third Party Advisory, VDB Entry
Changed	Reference Type	http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html No Types Assigned	http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html Exploit, Third Party Advisory, VDB Entry
Changed	Reference Type	http://seclists.org/fulldisclosure/2022/Jul/11 No Types Assigned	http://seclists.org/fulldisclosure/2022/Jul/11 Mailing List, Third Party Advisory
Removed	CWE	NIST CWE-502
Added	CWE		NIST CWE-917

CVE Modified by [email protected]

Aug. 03, 2022

Action Type Old Value New Value

Added Reference http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html [No Types Assigned]
CVE Modified by [email protected]

Jul. 22, 2022

Action Type Old Value New Value

Added Reference http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html [No Types Assigned]
CVE Modified by [email protected]

Jul. 22, 2022

Action Type Old Value New Value

Added Reference http://seclists.org/fulldisclosure/2022/Jul/11 [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		http://seclists.org/fulldisclosure/2022/Jul/11 [No Types Assigned]

Modified Analysis by [email protected]

Jun. 30, 2022

Action	Type	Old Value	New Value
Changed	Reference Type	https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228 No Types Assigned	https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228 Exploit, Third Party Advisory
Changed	Reference Type	https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html No Types Assigned	https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html Exploit, Third Party Advisory
Changed	Reference Type	https://www.oracle.com/security-alerts/cpuapr2022.html No Types Assigned	https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory

CVE Modified by [email protected]

May. 05, 2022

Action	Type	Old Value	New Value
Added	Reference		https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228 [No Types Assigned]
Added	Reference		https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html [No Types Assigned]

CVE Modified by [email protected]

Apr. 20, 2022

Action Type Old Value New Value

Added Reference https://www.oracle.com/security-alerts/cpuapr2022.html [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		https://www.oracle.com/security-alerts/cpuapr2022.html [No Types Assigned]

Reanalysis by [email protected]

Apr. 18, 2022

Action	Type	Old Value	New Value
Changed	Reference Type	http://seclists.org/fulldisclosure/2022/Mar/23 Third Party Advisory	http://seclists.org/fulldisclosure/2022/Mar/23 Mailing List, Third Party Advisory
Changed	CPE Configuration	OR cpe:2.3:a:apache:log4j:2.0:-::::::* cpe:2.3:a:apache:log4j:2.0:beta9::::::* cpe:2.3:a:apache:log4j:2.0:rc1::::::* cpe:2.3:a:apache:log4j:2.0:rc2::::::* cpe:2.3:a:apache:log4j::::::::* versions from (including) 2.0.1 up to (excluding) 2.3.1 cpe:2.3:a:apache:log4j::::::::* versions from (including) 2.4.0 up to (excluding) 2.12.2 cpe:2.3:a:apache:log4j::::::::* versions from (including) 2.13.0 up to (excluding) 2.17.1	OR cpe:2.3:a:apache:log4j:2.0:-::::::* cpe:2.3:a:apache:log4j:2.0:beta9::::::* cpe:2.3:a:apache:log4j:2.0:rc1::::::* cpe:2.3:a:apache:log4j:2.0:rc2::::::* cpe:2.3:a:apache:log4j::::::::* versions from (including) 2.0.1 up to (excluding) 2.3.1 cpe:2.3:a:apache:log4j::::::::* versions from (including) 2.4.0 up to (excluding) 2.12.2 cpe:2.3:a:apache:log4j::::::::* versions from (including) 2.13.0 up to (excluding) 2.15.0

Modified Analysis by [email protected]

Apr. 12, 2022

Action	Type	Old Value	New Value
Changed	Reference Type	http://seclists.org/fulldisclosure/2022/Mar/23 No Types Assigned	http://seclists.org/fulldisclosure/2022/Mar/23 Third Party Advisory
Changed	Reference Type	https://github.com/cisagov/log4j-affected-db No Types Assigned	https://github.com/cisagov/log4j-affected-db Third Party Advisory
Changed	Reference Type	https://support.apple.com/kb/HT213189 No Types Assigned	https://support.apple.com/kb/HT213189 Third Party Advisory
Changed	Reference Type	https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001 No Types Assigned	https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001 Third Party Advisory
Changed	CPE Configuration	OR cpe:2.3:a:apache:log4j:2.0:-::::::* cpe:2.3:a:apache:log4j:2.0:beta9::::::* cpe:2.3:a:apache:log4j:2.0:rc1::::::* cpe:2.3:a:apache:log4j:2.0:rc2::::::* cpe:2.3:a:apache:log4j::::::::* versions from (including) 2.0.1 up to (excluding) 2.3.1 cpe:2.3:a:apache:log4j::::::::* versions from (including) 2.4.0 up to (excluding) 2.12.2 cpe:2.3:a:apache:log4j::::::::* versions from (including) 2.13.0 up to (excluding) 2.15.0	OR cpe:2.3:a:apache:log4j:2.0:-::::::* cpe:2.3:a:apache:log4j:2.0:beta9::::::* cpe:2.3:a:apache:log4j:2.0:rc1::::::* cpe:2.3:a:apache:log4j:2.0:rc2::::::* cpe:2.3:a:apache:log4j::::::::* versions from (including) 2.0.1 up to (excluding) 2.3.1 cpe:2.3:a:apache:log4j::::::::* versions from (including) 2.4.0 up to (excluding) 2.12.2 cpe:2.3:a:apache:log4j::::::::* versions from (including) 2.13.0 up to (excluding) 2.17.1
Added	CPE Configuration		OR cpe:2.3:a:bentley:synchro:::::pro::: versions from (including) 6.1 up to (excluding) 6.4.3.2 cpe:2.3:a:bentley:synchro_4d:::::pro::: versions up to (excluding) 6.2.4.2

CVE Modified by [email protected]

Mar. 15, 2022

Action Type Old Value New Value

Added Reference http://seclists.org/fulldisclosure/2022/Mar/23 [No Types Assigned]
CVE Modified by [email protected]

Mar. 14, 2022

Action Type Old Value New Value

Added Reference https://support.apple.com/kb/HT213189 [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		http://seclists.org/fulldisclosure/2022/Mar/23 [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		https://support.apple.com/kb/HT213189 [No Types Assigned]

CVE Modified by [email protected]

Mar. 01, 2022

Action	Type	Old Value	New Value
Added	Reference		https://github.com/cisagov/log4j-affected-db [No Types Assigned]
Added	Reference		https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001 [No Types Assigned]

Modified Analysis by [email protected]

Feb. 19, 2022

Action	Type	Old Value	New Value
Changed	Reference Type	https://www.oracle.com/security-alerts/cpujan2022.html No Types Assigned	https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory

CVE Modified by [email protected]

Feb. 07, 2022

Action Type Old Value New Value

Added Reference https://www.oracle.com/security-alerts/cpujan2022.html [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		https://www.oracle.com/security-alerts/cpujan2022.html [No Types Assigned]

Modified Analysis by [email protected]

Feb. 01, 2022

Action	Type	Old Value	New Value
Changed	Reference Type	http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html No Types Assigned	http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html Third Party Advisory, VDB Entry
Changed	Reference Type	http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html No Types Assigned	http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html Third Party Advisory, VDB Entry
Changed	Reference Type	http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html No Types Assigned	http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html Third Party Advisory, VDB Entry
Changed	Reference Type	http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html No Types Assigned	http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html Third Party Advisory, VDB Entry
Changed	Reference Type	https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf No Types Assigned	https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf Third Party Advisory
Changed	Reference Type	https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf No Types Assigned	https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf Third Party Advisory
Changed	Reference Type	https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md No Types Assigned	https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md Product, US Government Resource
Changed	Reference Type	https://lists.fedoraproject.org/archives/list/[email protected]/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/ No Types Assigned	https://lists.fedoraproject.org/archives/list/[email protected]/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/ Third Party Advisory
Changed	Reference Type	https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/ Patch, Third Party Advisory	https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/ Patch, Third Party Advisory, Vendor Advisory
Changed	CPE Configuration	OR cpe:2.3:a:apache:log4j:2.0:-::::::* cpe:2.3:a:apache:log4j:2.0:beta9::::::* cpe:2.3:a:apache:log4j:2.0:rc1::::::* cpe:2.3:a:apache:log4j:2.0:rc2::::::* cpe:2.3:a:apache:log4j::::::::* versions from (including) 2.0.1 up to (excluding) 2.12.2 cpe:2.3:a:apache:log4j::::::::* versions from (including) 2.13.0 up to (excluding) 2.15.0	OR cpe:2.3:a:apache:log4j:2.0:-::::::* cpe:2.3:a:apache:log4j:2.0:beta9::::::* cpe:2.3:a:apache:log4j:2.0:rc1::::::* cpe:2.3:a:apache:log4j:2.0:rc2::::::* cpe:2.3:a:apache:log4j::::::::* versions from (including) 2.0.1 up to (excluding) 2.3.1 cpe:2.3:a:apache:log4j::::::::* versions from (including) 2.4.0 up to (excluding) 2.12.2 cpe:2.3:a:apache:log4j::::::::* versions from (including) 2.13.0 up to (excluding) 2.15.0
Changed	CPE Configuration	OR cpe:2.3:o:fedoraproject:fedora:35:::::::	OR cpe:2.3:o:fedoraproject:fedora:34::::::: cpe:2.3:o:fedoraproject:fedora:35:::::::

CVE Modified by [email protected]

Jan. 24, 2022

Action	Type	Old Value	New Value
Added	Reference		http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html [No Types Assigned]

CVE Modified by [email protected]

Jan. 20, 2022

Action	Type	Old Value	New Value
Added	Reference		http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html [No Types Assigned]

CVE Modified by [email protected]

Jan. 19, 2022

Action Type Old Value New Value

Added Reference https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md [No Types Assigned]

CVE Modified by [email protected]

Jan. 12, 2022

Action	Type	Old Value	New Value
Changed	Description	Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.	Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
Added	Reference		https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf [No Types Assigned]
Added	Reference		http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html [No Types Assigned]
Added	Reference		https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf [No Types Assigned]
Added	Reference		http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html [No Types Assigned]
Added	Reference		https://lists.fedoraproject.org/archives/list/[email protected]/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/ [No Types Assigned]

Reanalysis by [email protected]

Dec. 28, 2021

Action	Type	Old Value	New Value
Changed	Reference Type	https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/ Third Party Advisory	https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/ Patch, Third Party Advisory
Added	CPE Configuration		OR cpe:2.3:a:snowsoftware:snow_commander::::::::* versions up to (excluding) 8.10.0 cpe:2.3:a:snowsoftware:vm_access_proxy::::::::* versions up to (excluding) 3.6

Reanalysis by [email protected]

Dec. 20, 2021

Action	Type	Old Value	New Value
Changed	Reference Type	https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/ Mitigation, Third Party Advisory	https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/ Third Party Advisory
Added	CPE Configuration		OR cpe:2.3:a:cisco:automated_subsea_tuning:02.01.00::::::: cpe:2.3:a:cisco:broadworks:-::::::: cpe:2.3:a:cisco:cloudcenter_suite:4.10\(0.15\)::::::: cpe:2.3:a:cisco:cloudcenter_suite:5.3\(0\)::::::: cpe:2.3:a:cisco:cloudcenter_suite:5.4\(1\)::::::: cpe:2.3:a:cisco:cloudcenter_suite:5.5\(0\)::::::: cpe:2.3:a:cisco:cloudcenter_suite:5.5\(1\)::::::: cpe:2.3:a:cisco:common_services_platform_collector:002.009\(000.000\)::::::: cpe:2.3:a:cisco:common_services_platform_collector:002.009\(000.001\)::::::: cpe:2.3:a:cisco:common_services_platform_collector:002.009\(000.002\)::::::: cpe:2.3:a:cisco:common_services_platform_collector:002.009\(001.000\)::::::: cpe:2.3:a:cisco:common_services_platform_collector:002.009\(001.001\)::::::: cpe:2.3:a:cisco:common_services_platform_collector:002.009\(001.002\)::::::: cpe:2.3:a:cisco:common_services_platform_collector:002.010\(000.000\)::::::: cpe:2.3:a:cisco:connected_analytics_for_network_deployment:006.004.000.003::::::: cpe:2.3:a:cisco:connected_analytics_for_network_deployment:006.005.000.::::::: cpe:2.3:a:cisco:connected_analytics_for_network_deployment:006.005.000.000::::::: cpe:2.3:a:cisco:connected_analytics_for_network_deployment:007.000.001::::::: cpe:2.3:a:cisco:connected_analytics_for_network_deployment:007.001.000::::::: cpe:2.3:a:cisco:connected_analytics_for_network_deployment:007.002.000::::::: cpe:2.3:a:cisco:connected_analytics_for_network_deployment:7.3::::::: cpe:2.3:a:cisco:connected_analytics_for_network_deployment:007.003.000::::::: cpe:2.3:a:cisco:connected_analytics_for_network_deployment:007.003.001.001::::::: cpe:2.3:a:cisco:connected_analytics_for_network_deployment:007.003.003::::::: cpe:2.3:a:cisco:connected_analytics_for_network_deployment:008.000.000::::::: cpe:2.3:a:cisco:connected_analytics_for_network_deployment:008.000.000.000.004::::::: cpe:2.3:a:cisco:crosswork_network_automation:-::::::: cpe:2.3:a:cisco:crosswork_network_automation:2.0.0::::::: cpe:2.3:a:cisco:crosswork_network_automation:3.0.0::::::: cpe:2.3:a:cisco:crosswork_network_automation:4.1.0::::::: cpe:2.3:a:cisco:crosswork_network_automation:4.1.1::::::: cpe:2.3:a:cisco:cx_cloud_agent:001.012::::::: cpe:2.3:a:cisco:cyber_vision:4.0.2::::::: cpe:2.3:a:cisco:cyber_vision_sensor_management_extension:4.0.2::::::: cpe:2.3:a:cisco:dna_center:2.2.2.8::::::: cpe:2.3:a:cisco:dna_spaces:-::::::: cpe:2.3:a:cisco:dna_spaces_connector:-::::::: cpe:2.3:a:cisco:emergency_responder:11.5::::::: cpe:2.3:a:cisco:emergency_responder:11.5\(4.65000.14\)::::::: cpe:2.3:a:cisco:emergency_responder:11.5\(4.66000.14\)::::::: cpe:2.3:a:cisco:enterprise_chat_and_email:12.0\(1\)::::::: cpe:2.3:a:cisco:enterprise_chat_and_email:12.5\(1\)::::::: cpe:2.3:a:cisco:enterprise_chat_and_email:12.6\(1\)::::::: cpe:2.3:a:cisco:evolved_programmable_network_manager:3.0::::::: cpe:2.3:a:cisco:evolved_programmable_network_manager:3.1::::::: cpe:2.3:a:cisco:evolved_programmable_network_manager:4.0::::::: cpe:2.3:a:cisco:evolved_programmable_network_manager:4.1::::::: cpe:2.3:a:cisco:evolved_programmable_network_manager:5.0::::::: cpe:2.3:a:cisco:evolved_programmable_network_manager:5.1::::::: cpe:2.3:a:cisco:finesse:12.5\(1\):su1::::::* cpe:2.3:a:cisco:finesse:12.5\(1\):su2::::::* cpe:2.3:a:cisco:finesse:12.6\(1\):-::::::* cpe:2.3:a:cisco:finesse:12.6\(1\):es01::::::* cpe:2.3:a:cisco:finesse:12.6\(1\):es02::::::* cpe:2.3:a:cisco:finesse:12.6\(1\):es03::::::* cpe:2.3:a:cisco:firepower_threat_defense:6.2.3::::::: cpe:2.3:a:cisco:firepower_threat_defense:6.3.0::::::: cpe:2.3:a:cisco:firepower_threat_defense:6.4.0::::::: cpe:2.3:a:cisco:firepower_threat_defense:6.5.0::::::: cpe:2.3:a:cisco:firepower_threat_defense:6.6.0::::::: cpe:2.3:a:cisco:firepower_threat_defense:6.7.0::::::: cpe:2.3:a:cisco:firepower_threat_defense:7.0.0::::::: cpe:2.3:a:cisco:firepower_threat_defense:7.1.0::::::: cpe:2.3:a:cisco:identity_services_engine:002.004\(000.914\):-::::::* cpe:2.3:a:cisco:identity_services_engine:002.006\(000.156\):-::::::* cpe:2.3:a:cisco:identity_services_engine:002.007\(000.356\):-::::::* cpe:2.3:a:cisco:identity_services_engine:003.000\(000.458\):-::::::* cpe:2.3:a:cisco:identity_services_engine:003.001\(000.518\):-::::::* cpe:2.3:a:cisco:identity_services_engine:003.002\(000.116\):-::::::* cpe:2.3:a:cisco:integrated_management_controller_supervisor:002.003\(002.000\)::::::: cpe:2.3:a:cisco:integrated_management_controller_supervisor:2.3.2.0::::::: cpe:2.3:a:cisco:intersight_virtual_appliance:1.0.9-343::::::: cpe:2.3:a:cisco:mobility_services_engine:-::::::: cpe:2.3:a:cisco:network_assurance_engine:6.0\(2.1912\)::::::: cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.0\(1\)::::::: cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.1\(1\)::::::: cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.2\(1\)::::::: cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.3\(1\)::::::: cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.4\(1\)::::::: cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.5\(1\)::::::: cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.5\(2\)::::::: cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.5\(3\)::::::: cpe:2.3:a:cisco:network_insights_for_data_center:6.0\(2.1914\)::::::: cpe:2.3:a:cisco:network_services_orchestrator:-::::::: cpe:2.3:a:cisco:optical_network_controller:1.1::::::: cpe:2.3:a:cisco:paging_server:8.3\(1\)::::::: cpe:2.3:a:cisco:paging_server:8.4\(1\)::::::: cpe:2.3:a:cisco:paging_server:8.5\(1\)::::::: cpe:2.3:a:cisco:paging_server:9.0\(1\)::::::: cpe:2.3:a:cisco:paging_server:9.0\(2\)::::::: cpe:2.3:a:cisco:paging_server:9.1\(1\)::::::: cpe:2.3:a:cisco:paging_server:12.5\(2\)::::::: cpe:2.3:a:cisco:paging_server:14.0\(1\)::::::: cpe:2.3:a:cisco:prime_service_catalog:12.1::::::: cpe:2.3:a:cisco:sd-wan_vmanage:20.3::::::: cpe:2.3:a:cisco:sd-wan_vmanage:20.4::::::: cpe:2.3:a:cisco:sd-wan_vmanage:20.5::::::: cpe:2.3:a:cisco:sd-wan_vmanage:20.6::::::: cpe:2.3:a:cisco:sd-wan_vmanage:20.6.1::::::: cpe:2.3:a:cisco:sd-wan_vmanage:20.7::::::: cpe:2.3:a:cisco:sd-wan_vmanage:20.8::::::: cpe:2.3:a:cisco:smart_phy:3.1.2::::::: cpe:2.3:a:cisco:smart_phy:3.1.3::::::: cpe:2.3:a:cisco:smart_phy:3.1.4::::::: cpe:2.3:a:cisco:smart_phy:3.1.5::::::: cpe:2.3:a:cisco:smart_phy:3.2.1::::::: cpe:2.3:a:cisco:smart_phy:21.3::::::: cpe:2.3:a:cisco:ucs_central_software:2.0::::::: cpe:2.3:a:cisco:ucs_central_software:2.0\(1a\)::::::: cpe:2.3:a:cisco:ucs_central_software:2.0\(1b\)::::::: cpe:2.3:a:cisco:ucs_central_software:2.0\(1c\)::::::: cpe:2.3:a:cisco:ucs_central_software:2.0\(1d\)::::::: cpe:2.3:a:cisco:ucs_central_software:2.0\(1e\)::::::: cpe:2.3:a:cisco:ucs_central_software:2.0\(1f\)::::::: cpe:2.3:a:cisco:ucs_central_software:2.0\(1g\)::::::: cpe:2.3:a:cisco:ucs_central_software:2.0\(1h\)::::::: cpe:2.3:a:cisco:ucs_central_software:2.0\(1k\)::::::: cpe:2.3:a:cisco:ucs_central_software:2.0\(1l\)::::::: cpe:2.3:a:cisco:unified_communications_manager:11.5\(1.17900.52\)::::::: cpe:2.3:a:cisco:unified_communications_manager:11.5\(1.18119.2\)::::::: cpe:2.3:a:cisco:unified_communications_manager:11.5\(1.18900.97\)::::::: cpe:2.3:a:cisco:unified_communications_manager:11.5\(1.21900.40\)::::::: cpe:2.3:a:cisco:unified_communications_manager:11.5\(1.22900.28\)::::::: cpe:2.3:a:cisco:unified_communications_manager_im_\&_presence_service:11.5\(1\)::::::: cpe:2.3:a:cisco:unified_communications_manager_im_\&_presence_service:11.5\(1.22900.6\)::::::: cpe:2.3:a:cisco:unified_computing_system:006.008\(001.000\)::::::: cpe:2.3:a:cisco:unified_contact_center_enterprise:11.6\(2\)::::::: cpe:2.3:a:cisco:unified_contact_center_enterprise:12.0\(1\)::::::: cpe:2.3:a:cisco:unified_contact_center_enterprise:12.5\(1\)::::::: cpe:2.3:a:cisco:unified_contact_center_enterprise:12.6\(1\)::::::: cpe:2.3:a:cisco:unified_contact_center_enterprise:12.6\(2\)::::::: cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\):-::::::* cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\):su1::::::* cpe:2.3:a:cisco:unified_contact_center_express:12.6\(1\)::::::: cpe:2.3:a:cisco:unified_contact_center_express:12.6\(2\)::::::: cpe:2.3:a:cisco:unified_contact_center_management_portal:12.6\(1\)::::::: cpe:2.3:a:cisco:unified_customer_voice_portal:11.6\(1\)::::::: cpe:2.3:a:cisco:unified_customer_voice_portal:12.0\(1\)::::::: cpe:2.3:a:cisco:unified_customer_voice_portal:12.5\(1\)::::::: cpe:2.3:a:cisco:unified_customer_voice_portal:12.6\(1\)::::::: cpe:2.3:a:cisco:unified_intelligence_center:12.6\(1\):-::::::* cpe:2.3:a:cisco:unified_intelligence_center:12.6\(1\):es01::::::* cpe:2.3:a:cisco:unified_intelligence_center:12.6\(1\):es02::::::* cpe:2.3:a:cisco:unified_intelligence_center:12.6\(2\):-::::::* cpe:2.3:a:cisco:unified_sip_proxy:010.000\(000\)::::::: cpe:2.3:a:cisco:unified_sip_proxy:010.000\(001\)::::::: cpe:2.3:a:cisco:unified_sip_proxy:010.002\(000\)::::::: cpe:2.3:a:cisco:unified_sip_proxy:010.002\(001\)::::::: cpe:2.3:a:cisco:unified_workforce_optimization:11.5\(1\):sr7::::::* cpe:2.3:a:cisco:unity_connection:11.5::::::: cpe:2.3:a:cisco:unity_connection:11.5\(1.10000.6\)::::::: cpe:2.3:a:cisco:video_surveillance_manager:7.14\(1.26\)::::::: cpe:2.3:a:cisco:video_surveillance_manager:7.14\(2.26\)::::::: cpe:2.3:a:cisco:video_surveillance_manager:7.14\(3.025\)::::::: cpe:2.3:a:cisco:video_surveillance_manager:7.14\(4.018\)::::::: cpe:2.3:a:cisco:virtual_topology_system:2.6.6::::::: cpe:2.3:a:cisco:wan_automation_engine:7.1.3::::::: cpe:2.3:a:cisco:wan_automation_engine:7.2.1::::::: cpe:2.3:a:cisco:wan_automation_engine:7.2.2::::::: cpe:2.3:a:cisco:wan_automation_engine:7.2.3::::::: cpe:2.3:a:cisco:wan_automation_engine:7.3::::::: cpe:2.3:a:cisco:wan_automation_engine:7.4::::::: cpe:2.3:a:cisco:wan_automation_engine:7.5::::::: cpe:2.3:a:cisco:wan_automation_engine:7.6::::::: cpe:2.3:a:cisco:webex_meetings_server:3.0::::::: cpe:2.3:a:cisco:webex_meetings_server:4.0:::::::

Modified Analysis by [email protected]

Dec. 16, 2021

CVE Modified by [email protected]

Dec. 16, 2021

Action Type Old Value New Value

Added Reference https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/ [No Types Assigned]
CVE Modified by [email protected]

Dec. 16, 2021

Action Type Old Value New Value

Added Reference https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf [No Types Assigned]
CVE Modified by [email protected]

Dec. 15, 2021

Action Type Old Value New Value

Added Reference http://www.openwall.com/lists/oss-security/2021/12/15/3 [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/ [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		http://www.openwall.com/lists/oss-security/2021/12/15/3 [No Types Assigned]

CVE Modified by [email protected]

Dec. 15, 2021

Action	Type	New Value
Added	Reference	http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html [No Types Assigned]
Added	Reference	http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html [No Types Assigned]
Added	Reference	http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html [No Types Assigned]

CVE Modified by [email protected]

Dec. 15, 2021

Action	Type	Old Value	New Value
Changed	Description	Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.	Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
Removed	Reference	http://www.openwall.com/lists/oss-security/2021/12/15/1 [No Types Assigned]
Added	Reference		http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html [No Types Assigned]
Added	Reference		http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html [No Types Assigned]

CVE Modified by [email protected]

Dec. 15, 2021

Action	Type	Old Value	New Value
Changed	Description	Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).	Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
Added	Reference		http://www.openwall.com/lists/oss-security/2021/12/15/1 [No Types Assigned]

CVE Modified by [email protected]

Dec. 15, 2021

Action Type Old Value New Value

Added Reference https://www.kb.cert.org/vuls/id/930724 [No Types Assigned]
CVE Modified by [email protected]

Dec. 15, 2021

Action Type Old Value New Value

Added Reference https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html [No Types Assigned]
CVE Modified by [email protected]

Dec. 14, 2021

Action Type Old Value New Value

Added Reference http://www.openwall.com/lists/oss-security/2021/12/14/4 [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		https://www.kb.cert.org/vuls/id/930724 [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		http://www.openwall.com/lists/oss-security/2021/12/14/4 [No Types Assigned]

CVE Modified by [email protected]

Dec. 14, 2021

Action	Type	New Value
Added	Reference	http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html [No Types Assigned]
Added	Reference	http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html [No Types Assigned]
Added	Reference	http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html [No Types Assigned]

CVE Modified by [email protected]

Dec. 14, 2021

Action Type Old Value New Value

Added Reference https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf [No Types Assigned]

CVE Modified by [email protected]

Dec. 14, 2021

Action	Type	Old Value	New Value
Changed	Description	Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). Java 8u121 (see https://www.oracle.com/java/technologies/javase/8u121-relnotes.html) protects against remote code execution by defaulting "com.sun.jndi.rmi.object.trustURLCodebase" and "com.sun.jndi.cosnaming.object.trustURLCodebase" to "false".	Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).
Added	Reference		https://twitter.com/kurtseifried/status/1469345530182455296 [No Types Assigned]
Added	Reference		https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html [No Types Assigned]
Added	Reference		https://www.debian.org/security/2021/dsa-5020 [No Types Assigned]

CVE Modified by [email protected]

Dec. 13, 2021

Action	Type	Old Value	New Value
Added	Reference		http://www.openwall.com/lists/oss-security/2021/12/13/1 [No Types Assigned]
Added	Reference		http://www.openwall.com/lists/oss-security/2021/12/13/2 [No Types Assigned]

CVE Modified by [email protected]

Dec. 13, 2021

Action Type Old Value New Value

Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/ [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		https://lists.fedoraproject.org/archives/list/[email protected]/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/ [No Types Assigned]

Initial Analysis by [email protected]

Dec. 13, 2021

Action	Type	Old Value	New Value
Added	CVSS V2		NIST (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Added	CVSS V3.1		NIST AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Changed	Reference Type	http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html No Types Assigned	http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html Third Party Advisory, VDB Entry
Changed	Reference Type	http://www.openwall.com/lists/oss-security/2021/12/10/1 No Types Assigned	http://www.openwall.com/lists/oss-security/2021/12/10/1 Mailing List, Mitigation, Third Party Advisory
Changed	Reference Type	http://www.openwall.com/lists/oss-security/2021/12/10/2 No Types Assigned	http://www.openwall.com/lists/oss-security/2021/12/10/2 Mailing List, Mitigation, Third Party Advisory
Changed	Reference Type	http://www.openwall.com/lists/oss-security/2021/12/10/3 No Types Assigned	http://www.openwall.com/lists/oss-security/2021/12/10/3 Mailing List, Third Party Advisory
Changed	Reference Type	https://logging.apache.org/log4j/2.x/security.html No Types Assigned	https://logging.apache.org/log4j/2.x/security.html Release Notes, Vendor Advisory
Changed	Reference Type	https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 No Types Assigned	https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 Third Party Advisory
Changed	Reference Type	https://security.netapp.com/advisory/ntap-20211210-0007/ No Types Assigned	https://security.netapp.com/advisory/ntap-20211210-0007/ Vendor Advisory
Changed	Reference Type	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd No Types Assigned	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd Third Party Advisory
Changed	Reference Type	https://www.oracle.com/security-alerts/alert-cve-2021-44228.html No Types Assigned	https://www.oracle.com/security-alerts/alert-cve-2021-44228.html Third Party Advisory
Added	CWE		NIST CWE-502
Added	CPE Configuration		OR cpe:2.3:a:apache:log4j:2.0:-::::::* cpe:2.3:a:apache:log4j:2.0:beta9::::::* cpe:2.3:a:apache:log4j:2.0:rc1::::::* cpe:2.3:a:apache:log4j:2.0:rc2::::::* cpe:2.3:a:apache:log4j::::::::* versions from (including) 2.0.1 up to (excluding) 2.15.0

CVE Modified by [email protected]

Dec. 13, 2021

Action	Type	Old Value	New Value
Changed	Description	Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).	Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). Java 8u121 (see https://www.oracle.com/java/technologies/javase/8u121-relnotes.html) protects against remote code execution by defaulting "com.sun.jndi.rmi.object.trustURLCodebase" and "com.sun.jndi.cosnaming.object.trustURLCodebase" to "false".

CVE Modified by [email protected]

Dec. 13, 2021

Action Type Old Value New Value

Added Reference https://www.oracle.com/security-alerts/alert-cve-2021-44228.html [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		https://www.oracle.com/security-alerts/alert-cve-2021-44228.html [No Types Assigned]

CVE Modified by [email protected]

Dec. 12, 2021

Action	Type	Old Value	New Value
Changed	Description	Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). Java 8u121 (see https://www.oracle.com/java/technologies/javase/8u121-relnotes.html) protects against remote code execution by defaulting "com.sun.jndi.rmi.object.trustURLCodebase" and "com.sun.jndi.cosnaming.object.trustURLCodebase" to "false".	Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).
Removed	Reference	https://www.debian.org/security/2021/dsa-5020 [No Types Assigned]

CVE Modified by [email protected]

Dec. 12, 2021

Action Type Old Value New Value

Added Reference https://www.debian.org/security/2021/dsa-5020 [No Types Assigned]
CVE Modified by [email protected]

Dec. 11, 2021

Action Type Old Value New Value

Added Reference https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 [No Types Assigned]

Action	Type	Old Value	New Value
Added	Reference		https://www.debian.org/security/2021/dsa-5020 [No Types Assigned]

CVE Modified by [email protected]

Dec. 10, 2021

Action	Type	Old Value	New Value
Added	Reference		https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd [No Types Assigned]
Added	Reference		http://www.openwall.com/lists/oss-security/2021/12/10/3 [No Types Assigned]

CVE Modified by [email protected]

Dec. 10, 2021

Action	Type	Old Value	New Value
Added	Reference		http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html [No Types Assigned]
Added	Reference		https://security.netapp.com/advisory/ntap-20211210-0007/ [No Types Assigned]

CVE Modified by [email protected]

Dec. 10, 2021

Action	Type	Old Value	New Value
Added	Reference		http://www.openwall.com/lists/oss-security/2021/12/10/1 [No Types Assigned]
Added	Reference		http://www.openwall.com/lists/oss-security/2021/12/10/2 [No Types Assigned]

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2021-44228 is associated with the following CWEs:

CWE-20: Improper Input Validation

CWE-400: Uncontrolled Resource Consumption

CWE-502: Deserialization of Untrusted Data

CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2021-44228 weaknesses.

CAPEC-3: Using Leading 'Ghost' Character Sequences to Bypass Input Filters Using Leading 'Ghost' Character Sequences to Bypass Input Filters CAPEC-7: Blind SQL Injection Blind SQL Injection CAPEC-8: Buffer Overflow in an API Call Buffer Overflow in an API Call CAPEC-9: Buffer Overflow in Local Command-Line Utilities Buffer Overflow in Local Command-Line Utilities CAPEC-10: Buffer Overflow via Environment Variables Buffer Overflow via Environment Variables CAPEC-13: Subverting Environment Variable Values Subverting Environment Variable Values CAPEC-14: Client-side Injection-induced Buffer Overflow Client-side Injection-induced Buffer Overflow CAPEC-22: Exploiting Trust in Client Exploiting Trust in Client CAPEC-23: File Content Injection File Content Injection CAPEC-24: Filter Failure through Buffer Overflow Filter Failure through Buffer Overflow CAPEC-28: Fuzzing Fuzzing CAPEC-31: Accessing/Intercepting/Modifying HTTP Cookies Accessing/Intercepting/Modifying HTTP Cookies CAPEC-42: MIME Conversion MIME Conversion CAPEC-43: Exploiting Multiple Input Interpretation Layers Exploiting Multiple Input Interpretation Layers CAPEC-45: Buffer Overflow via Symbolic Links Buffer Overflow via Symbolic Links CAPEC-46: Overflow Variables and Tags Overflow Variables and Tags CAPEC-47: Buffer Overflow via Parameter Expansion Buffer Overflow via Parameter Expansion CAPEC-52: Embedding NULL Bytes Embedding NULL Bytes CAPEC-53: Postfix, Null Terminate, and Backslash Postfix, Null Terminate, and Backslash CAPEC-63: Cross-Site Scripting (XSS) Cross-Site Scripting (XSS) CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic Using Slashes and URL Encoding Combined to Bypass Validation Logic CAPEC-67: String Format Overflow in syslog() String Format Overflow in syslog() CAPEC-71: Using Unicode Encoding to Bypass Validation Logic Using Unicode Encoding to Bypass Validation Logic CAPEC-72: URL Encoding URL Encoding CAPEC-73: User-Controlled Filename User-Controlled Filename CAPEC-78: Using Escaped Slashes in Alternate Encoding Using Escaped Slashes in Alternate Encoding CAPEC-79: Using Slashes in Alternate Encoding Using Slashes in Alternate Encoding CAPEC-80: Using UTF-8 Encoding to Bypass Validation Logic Using UTF-8 Encoding to Bypass Validation Logic CAPEC-81: Web Server Logs Tampering Web Server Logs Tampering CAPEC-83: XPath Injection XPath Injection CAPEC-85: AJAX Footprinting AJAX Footprinting CAPEC-88: OS Command Injection OS Command Injection CAPEC-101: Server Side Include (SSI) Injection Server Side Include (SSI) Injection CAPEC-104: Cross Zone Scripting Cross Zone Scripting CAPEC-108: Command Line Execution through SQL Injection Command Line Execution through SQL Injection CAPEC-109: Object Relational Mapping Injection Object Relational Mapping Injection CAPEC-110: SQL Injection through SOAP Parameter Tampering SQL Injection through SOAP Parameter Tampering CAPEC-120: Double Encoding Double Encoding CAPEC-135: Format String Injection Format String Injection CAPEC-136: LDAP Injection LDAP Injection CAPEC-153: Input Data Manipulation Input Data Manipulation CAPEC-182: Flash Injection Flash Injection CAPEC-209: XSS Using MIME Type Mismatch XSS Using MIME Type Mismatch CAPEC-230: Serialized Data with Nested Payloads Serialized Data with Nested Payloads CAPEC-231: Oversized Serialized Data Payloads Oversized Serialized Data Payloads CAPEC-250: XML Injection XML Injection CAPEC-261: Fuzzing for garnering other adjacent user/sensitive data Fuzzing for garnering other adjacent user/sensitive data CAPEC-267: Leverage Alternate Encoding Leverage Alternate Encoding CAPEC-473: Signature Spoof Signature Spoof CAPEC-588: DOM-Based XSS DOM-Based XSS CAPEC-664: Server Side Request Forgery Server Side Request Forgery CAPEC-147: XML Ping of the Death XML Ping of the Death CAPEC-227: Sustained Client Engagement Sustained Client Engagement CAPEC-492: Regular Expression Exponential Blowup Regular Expression Exponential Blowup CAPEC-586: Object Injection Object Injection