Known Exploited Vulnerability
9.0
CRITICAL
CVE-2021-45046
Apache Log4j2 Deserialization of Untrusted Data Vu - [Actively Exploited]
Description

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

INFO

Published Date :

Dec. 14, 2021, 7:15 p.m.

Last Modified :

Oct. 31, 2024, 12:17 p.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

6.0

Exploitability Score :

2.2
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.

Required Action :

Apply updates per vendor instructions.

Notes :

https://logging.apache.org/log4j/2.x/security.html

Public PoC/Exploit Available at Github

CVE-2021-45046 has a 248 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2021-45046 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Siemens logo\!_soft_comfort
2 Siemens spectrum_power_4
3 Siemens spectrum_power_7
4 Siemens teamcenter
5 Siemens sipass_integrated
6 Siemens mendix
7 Siemens comos
8 Siemens siveillance_control_pro
9 Siemens gma-manager
10 Siemens operation_scheduler
11 Siemens industrial_edge_management
12 Siemens opcenter_intelligence
13 Siemens sppa-t3000_ses3000_firmware
14 Siemens captial
15 Siemens desigo_cc_advanced_reports
16 Siemens desigo_cc_info_center
17 Siemens e-car_operation_center
18 Siemens energy_engage
19 Siemens energyip
20 Siemens energyip_prepay
21 Siemens head-end_system_universal_device_integration_system
22 Siemens industrial_edge_management_hub
23 Siemens mindsphere
24 Siemens navigator
25 Siemens nx
26 Siemens sentron_powermanager
27 Siemens siguard_dsa
28 Siemens siveillance_command
29 Siemens siveillance_identity
30 Siemens siveillance_vantage
31 Siemens siveillance_viewpoint
32 Siemens solid_edge_cam_pro
33 Siemens solid_edge_harness_design
34 Siemens vesys
35 Siemens xpedition_enterprise
36 Siemens xpedition_package_integrator
37 Siemens tracealertserverplus
38 Siemens 6bk1602-0aa12-0tp0_firmware
39 Siemens 6bk1602-0aa22-0tp0_firmware
40 Siemens 6bk1602-0aa32-0tp0_firmware
41 Siemens 6bk1602-0aa42-0tp0_firmware
42 Siemens 6bk1602-0aa52-0tp0_firmware
43 Siemens sppa-t3000_ses3000
44 Siemens 6bk1602-0aa12-0tp0
45 Siemens 6bk1602-0aa22-0tp0
46 Siemens 6bk1602-0aa32-0tp0
47 Siemens 6bk1602-0aa42-0tp0
48 Siemens 6bk1602-0aa52-0tp0
1 Intel audio_development_kit
2 Intel computer_vision_annotation_tool
3 Intel genomics_kernel_library
4 Intel secure_device_onboard
5 Intel sensor_solution_firmware_development_kit
6 Intel system_debugger
7 Intel system_studio
8 Intel datacenter_manager
9 Intel oneapi
1 Fedoraproject fedora
1 Debian debian_linux
1 Apache log4j
1 Sonicwall email_security
1 Cvat computer_vision_annotation_tool
: Total Affected Vendor : 7 | Products : 62
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2021-45046.

URL Resource
http://www.openwall.com/lists/oss-security/2021/12/14/4 Mailing List Mitigation Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/15/3 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/18/1 Mailing List Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ Mailing List Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ Mailing List Release Notes
https://logging.apache.org/log4j/2.x/security.html Mitigation Release Notes Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 Third Party Advisory
https://security.gentoo.org/glsa/202310-16 Third Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-44228 Not Applicable
https://www.debian.org/security/2021/dsa-5022 Third Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html Third Party Advisory
https://www.kb.cert.org/vuls/id/930724 Third Party Advisory US Government Resource
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
dybson3/Forage-Internship-AIG

A quick description of what I did in Forage Internship. It was mainly focused on learning about Log4j vulnerability and advising how to mitigate it. In the second part of the internship I had to conduct a brute-force attack on encrypted files.

Updated: 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Nov. 7, 2024, 12:28 p.m. This repo has been linked 2 different CVEs too.
Profile Photo
byt3n33dl3/thc-Nuclei

🧛🏻 Nuclei is a fast Customizable SSL scanner powered by Offensive Community, built on .NET's DLR based DSL. Zero shot vulnerability discovery.

cybersecurity nuclei-templates offensive-security penetration-testing cve-scanning engine kali-linux scanner vulnerability-scanners

Dockerfile Makefile Go Shell Smarty Python TypeScript JavaScript C# C++

Updated: 2 weeks, 6 days ago
2 stars 0 fork 0 watcher
Born at : Oct. 26, 2024, 8:57 a.m. This repo has been linked 7 different CVEs too.
Profile Photo
80486858/repo-6

None

Java

Updated: 1 month ago
0 stars 0 fork 0 watcher
Born at : Oct. 13, 2024, 1:56 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
a-ramses/security-research

None

CodeQL Shell Python C Java Go Assembly Makefile GDB C++

Updated: 1 month, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Oct. 6, 2024, 9:55 p.m. This repo has been linked 10 different CVEs too.
Profile Photo
CGCL-codes/LibHunter

None

Python Shell Batchfile

Updated: 2 months ago
0 stars 0 fork 0 watcher
Born at : Sept. 14, 2024, 5:56 a.m. This repo has been linked 89 different CVEs too.
Profile Photo
jbeagles8755a0/security-research

None

CodeQL Shell Python C Java Go Assembly Makefile GDB C++

Updated: 2 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Sept. 6, 2024, 8:39 a.m. This repo has been linked 10 different CVEs too.
Profile Photo
abozzoni/cve-app

None

Dockerfile Java

Updated: 2 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Sept. 3, 2024, 2:38 p.m. This repo has been linked 3 different CVEs too.
Profile Photo
Coolaid003/Security-Research

None

CodeQL Shell Python C Java Go Assembly Makefile GDB C++

Updated: 2 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : Aug. 29, 2024, 9:55 p.m. This repo has been linked 10 different CVEs too.
Profile Photo
codie3/docker-jmeter

None

Dockerfile Makefile Shell

Updated: 4 months ago
0 stars 0 fork 0 watcher
Born at : July 16, 2024, 9:50 p.m. This repo has been linked 2 different CVEs too.
Profile Photo
ralvares/ssvc.me

Exploit & Vulnerability Intelligence Repository

Python

Updated: 2 months, 1 week ago
14 stars 2 fork 2 watcher
Born at : July 1, 2024, 12:22 p.m. This repo has been linked 2 different CVEs too.
Profile Photo
bananaacaat/Log4j-Detector

None

Java

Updated: 5 months ago
0 stars 0 fork 0 watcher
Born at : June 16, 2024, 4:31 p.m. This repo has been linked 4 different CVEs too.
Profile Photo
LibHunter/LibHunter

None

Python Shell Batchfile

Updated: 5 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : June 5, 2024, 8:22 a.m. This repo has been linked 89 different CVEs too.
Profile Photo
grvuolo/wsa-spgi-lab

None

Java Dockerfile Roff Shell Batchfile C# Smalltalk

Updated: 5 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : May 25, 2024, 4:48 p.m. This repo has been linked 3 different CVEs too.
Profile Photo
stuartwdouglasmidstream/github--census-instrumentation--opencensus-java

None

Dockerfile Shell Java Python Batchfile

Updated: 6 months ago
0 stars 0 fork 0 watcher
Born at : May 15, 2024, 4:43 a.m. This repo has been linked 2 different CVEs too.
Profile Photo
shaily29-eng/CyberSecurity_CVE-2021-45046

None

Updated: 5 months, 4 weeks ago
0 stars 0 fork 0 watcher
Born at : May 9, 2024, 3:04 a.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2021-45046 vulnerability anywhere in the article.

  • Google Cloud
Ransomware Rebounds: Extortion Threat Surges in 2023, Attackers Rely on Publicly Available and Legitimate Tools

Written by: Bavi Sadayappan, Zach Riddle, Jordan Nuce, Joshua Shilko, Jeremy Kennelly A version of this blog post was published to the Mandiant Advantage portal on April 18, 2024. Executive Summary In ... Read more

Published Date: Jun 03, 2024 (5 months, 2 weeks ago)
CVE-2023-22518 CVE-2023-46604 CVE-2023-4966 CVE-2023-40044 CVE-2023-20269 CVE-2023-3519 CVE-2023-3539 CVE-2023-28252 CVE-2023-24880 CVE-2022-47966 ...+11 more CVE
  • curatedintel.org
Nightmare Before Christmas - Curated Intel's Response To Log4Shell

Written by @BushidoToken, @TrevorGiffen | Edited by @SteveD3On late Thursday, 9 December, security researchers warned of a critical vulnerability with wide ramifications. With a CVSS score of 10.0 (Cr ... Read more

Published Date: Dec 21, 2021 (2 years, 10 months ago)
CVE-2021-45105 CVE-2021-45046 CVE-2021-4104 CVE-2021-44228

The following table lists the changes that have been made to the CVE-2021-45046 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CPE Deprecation Remap by [email protected]

    Oct. 31, 2024

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:a:intel:computer_vision_annotation_tool:-:*:*:*:*:*:*:* OR *cpe:2.3:a:cvat:computer_vision_annotation_tool:-:*:*:*:*:*:*:*
  • Modified Analysis by [email protected]

    Jun. 27, 2024

    Action Type Old Value New Value
    Changed Reference Type https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ No Types Assigned https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ Mailing List, Release Notes
    Changed Reference Type https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ No Types Assigned https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ Mailing List, Release Notes
    Changed Reference Type https://security.gentoo.org/glsa/202310-16 No Types Assigned https://security.gentoo.org/glsa/202310-16 Third Party Advisory
    Changed CPE Configuration AND OR cpe:2.3:h:siemens:sppa-t3000_ses3000:-:*:*:*:*:*:*:* OR *cpe:2.3:o:siemens:sppa-t3000_ses3000_firmware:*:*:*:*:*:*:*:* AND OR *cpe:2.3:o:siemens:sppa-t3000_ses3000_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:siemens:sppa-t3000_ses3000:-:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Oct. 26, 2023

    Action Type Old Value New Value
    Added Reference https://security.gentoo.org/glsa/202310-16 [No Types Assigned]
  • CVE Modified by [email protected]

    Jun. 27, 2023

    Action Type Old Value New Value
    Removed Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ [Mailing List, Third Party Advisory]
    Removed Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ [Mailing List, Third Party Advisory]
    Added Reference https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ [No Types Assigned]
    Added Reference https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ [No Types Assigned]
    Removed CWE Apache Software Foundation CWE-502
    Added CWE Apache Software Foundation CWE-917
    Removed CWE Reason CWE-502 / More specific CWE option available
  • Reanalysis by [email protected]

    Jun. 26, 2023

    Action Type Old Value New Value
    Removed CWE NIST CWE-502
    Added CWE NIST CWE-917
  • Modified Analysis by [email protected]

    Oct. 06, 2022

    Action Type Old Value New Value
    Changed Reference Type https://www.oracle.com/security-alerts/cpuapr2022.html No Types Assigned https://www.oracle.com/security-alerts/cpuapr2022.html Third Party Advisory
    Changed Reference Type https://www.oracle.com/security-alerts/cpujul2022.html No Types Assigned https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
  • CVE Modified by [email protected]

    Jul. 25, 2022

    Action Type Old Value New Value
    Added Reference https://www.oracle.com/security-alerts/cpujul2022.html [No Types Assigned]
  • CVE Modified by [email protected]

    Apr. 20, 2022

    Action Type Old Value New Value
    Added Reference https://www.oracle.com/security-alerts/cpuapr2022.html [No Types Assigned]
  • Modified Analysis by [email protected]

    Feb. 19, 2022

    Action Type Old Value New Value
    Changed Reference Type https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf No Types Assigned https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf Third Party Advisory
    Changed Reference Type https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf No Types Assigned https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf Third Party Advisory
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ Mailing List, Third Party Advisory
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ Mailing List, Third Party Advisory
    Changed Reference Type https://www.oracle.com/security-alerts/cpujan2022.html No Types Assigned https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory
    Changed CPE Configuration OR *cpe:2.3:a:siemens:captial:*:*:*:*:*:*:*:* versions up to (excluding) 2019.1 *cpe:2.3:a:siemens:captial:2019.1:-:*:*:*:*:*:* *cpe:2.3:a:siemens:captial:2019.1:sp1912:*:*:*:*:*:* *cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.0:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.2:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.0:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_info_center:5.0:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_info_center:5.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:e-car_operation_center:*:*:*:*:*:*:*:* versions up to (excluding) 2021-12-13 *cpe:2.3:a:siemens:energy_engage:3.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip:8.5:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip:8.6:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip:8.7:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip:9.0:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip_prepay:3.7:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip_prepay:3.8:*:*:*:*:*:*:* *cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:* versions up to (excluding) 8.6.2j-398 *cpe:2.3:a:siemens:head-end_system_universal_device_integration_system:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:industrial_edge_management:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:industrial_edge_management_hub:*:*:*:*:*:*:*:* versions up to (excluding) 2021-12-13 *cpe:2.3:a:siemens:logo\!_soft_comfort:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:mindsphere:*:*:*:*:*:*:*:* versions up to (excluding) 2021-12-11 *cpe:2.3:a:siemens:navigator:*:*:*:*:*:*:*:* versions up to (excluding) 2021-12-13 *cpe:2.3:a:siemens:nx:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:* versions up to (including) 3.2 *cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:* versions up to (including) 1.1.3 *cpe:2.3:a:siemens:sentron_powermanager:4.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:sentron_powermanager:4.2:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siguard_dsa:4.2:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siguard_dsa:4.3:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siguard_dsa:4.4:*:*:*:*:*:*:* *cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:* *cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_command:*:*:*:*:*:*:*:* versions up to (including) 4.16.2.1 *cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_vantage:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_viewpoint:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:solid_edge_cam_pro:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:solid_edge_harness_design:*:*:*:*:*:*:*:* versions up to (excluding) 2020 *cpe:2.3:a:siemens:solid_edge_harness_design:2020:*:*:*:*:*:*:* *cpe:2.3:a:siemens:solid_edge_harness_design:2020:-:*:*:*:*:*:* *cpe:2.3:a:siemens:solid_edge_harness_design:2020:sp2002:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_4:*:*:*:*:*:*:*:* versions up to (excluding) 4.70 *cpe:2.3:a:siemens:spectrum_power_4:4.70:-:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_4:4.70:sp7:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_4:4.70:sp8:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_7:*:*:*:*:*:*:*:* versions up to (excluding) 2.30 *cpe:2.3:a:siemens:spectrum_power_7:2.30:*:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_7:2.30:-:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_7:2.30:sp2:*:*:*:*:*:* *cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:vesys:*:*:*:*:*:*:*:* versions up to (excluding) 2019.1 *cpe:2.3:a:siemens:vesys:2019.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:vesys:2019.1:-:*:*:*:*:*:* *cpe:2.3:a:siemens:vesys:2019.1:sp1912:*:*:*:*:*:* *cpe:2.3:a:siemens:xpedition_enterprise:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:xpedition_package_integrator:-:*:*:*:*:*:*:* OR *cpe:2.3:a:siemens:captial:*:*:*:*:*:*:*:* versions up to (excluding) 2019.1 *cpe:2.3:a:siemens:captial:2019.1:-:*:*:*:*:*:* *cpe:2.3:a:siemens:captial:2019.1:sp1912:*:*:*:*:*:* *cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.0:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.2:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.0:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_info_center:5.0:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_info_center:5.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:e-car_operation_center:*:*:*:*:*:*:*:* versions up to (excluding) 2021-12-13 *cpe:2.3:a:siemens:energy_engage:3.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip:8.5:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip:8.6:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip:8.7:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip:9.0:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip_prepay:3.7:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip_prepay:3.8:*:*:*:*:*:*:* *cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:* versions up to (excluding) 8.6.2j-398 *cpe:2.3:a:siemens:head-end_system_universal_device_integration_system:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:industrial_edge_management:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:industrial_edge_management_hub:*:*:*:*:*:*:*:* versions up to (excluding) 2021-12-13 *cpe:2.3:a:siemens:logo\!_soft_comfort:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:mindsphere:*:*:*:*:*:*:*:* versions up to (excluding) 2021-12-11 *cpe:2.3:a:siemens:navigator:*:*:*:*:*:*:*:* versions up to (excluding) 2021-12-13 *cpe:2.3:a:siemens:nx:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:* versions up to (including) 3.2 *cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:* versions up to (including) 1.1.3 *cpe:2.3:a:siemens:sentron_powermanager:4.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:sentron_powermanager:4.2:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siguard_dsa:4.2:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siguard_dsa:4.3:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siguard_dsa:4.4:*:*:*:*:*:*:* *cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:* *cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_command:*:*:*:*:*:*:*:* versions up to (including) 4.16.2.1 *cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_vantage:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_viewpoint:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:solid_edge_cam_pro:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:solid_edge_harness_design:*:*:*:*:*:*:*:* versions up to (excluding) 2020 *cpe:2.3:a:siemens:solid_edge_harness_design:2020:*:*:*:*:*:*:* *cpe:2.3:a:siemens:solid_edge_harness_design:2020:-:*:*:*:*:*:* *cpe:2.3:a:siemens:solid_edge_harness_design:2020:sp2002:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_4:*:*:*:*:*:*:*:* versions up to (excluding) 4.70 *cpe:2.3:a:siemens:spectrum_power_4:4.70:-:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_4:4.70:sp7:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_4:4.70:sp8:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_7:*:*:*:*:*:*:*:* versions up to (excluding) 2.30 *cpe:2.3:a:siemens:spectrum_power_7:2.30:*:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_7:2.30:-:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_7:2.30:sp2:*:*:*:*:*:* *cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:tracealertserverplus:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:vesys:*:*:*:*:*:*:*:* versions up to (excluding) 2019.1 *cpe:2.3:a:siemens:vesys:2019.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:vesys:2019.1:-:*:*:*:*:*:* *cpe:2.3:a:siemens:vesys:2019.1:sp1912:*:*:*:*:*:* *cpe:2.3:a:siemens:xpedition_enterprise:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:xpedition_package_integrator:-:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:6bk1602-0aa12-0tp0_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.0 OR cpe:2.3:h:siemens:6bk1602-0aa12-0tp0:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:6bk1602-0aa22-0tp0_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.0 OR cpe:2.3:h:siemens:6bk1602-0aa22-0tp0:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:6bk1602-0aa32-0tp0_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.0 OR cpe:2.3:h:siemens:6bk1602-0aa32-0tp0:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:6bk1602-0aa42-0tp0_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.0 OR cpe:2.3:h:siemens:6bk1602-0aa42-0tp0:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:6bk1602-0aa52-0tp0_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.0 OR cpe:2.3:h:siemens:6bk1602-0aa52-0tp0:-:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Feb. 07, 2022

    Action Type Old Value New Value
    Added Reference https://www.oracle.com/security-alerts/cpujan2022.html [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 27, 2021

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ [No Types Assigned]
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 22, 2021

    Action Type Old Value New Value
    Added Reference https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 21, 2021

    Action Type Old Value New Value
    Added Reference https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf [No Types Assigned]
  • Modified Analysis by [email protected]

    Dec. 20, 2021

    Action Type Old Value New Value
    Removed CVSS V2 NIST (AV:N/AC:H/Au:N/C:N/I:N/A:P)
    Added CVSS V2 NIST (AV:N/AC:H/Au:N/C:P/I:P/A:P)
    Removed CVSS V3.1 NIST AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
    Added CVSS V3.1 NIST AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
    Changed Reference Type http://www.openwall.com/lists/oss-security/2021/12/18/1 No Types Assigned http://www.openwall.com/lists/oss-security/2021/12/18/1 Mailing List, Third Party Advisory
    Changed Reference Type https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 No Types Assigned https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 Third Party Advisory
    Changed Reference Type https://www.debian.org/security/2021/dsa-5022 No Types Assigned https://www.debian.org/security/2021/dsa-5022 Third Party Advisory
    Changed Reference Type https://www.oracle.com/security-alerts/alert-cve-2021-44228.html No Types Assigned https://www.oracle.com/security-alerts/alert-cve-2021-44228.html Third Party Advisory
    Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.12
  • CVE Modified by [email protected]

    Dec. 20, 2021

    Action Type Old Value New Value
    Changed Description It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 makes a best-effort attempt to restrict JNDI LDAP lookups to localhost by default. Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
  • CVE Modified by [email protected]

    Dec. 18, 2021

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2021/12/18/1 [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 18, 2021

    Action Type Old Value New Value
    Added Reference https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 17, 2021

    Action Type Old Value New Value
    Added Reference https://www.oracle.com/security-alerts/alert-cve-2021-44228.html [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 16, 2021

    Action Type Old Value New Value
    Added Reference https://www.debian.org/security/2021/dsa-5022 [No Types Assigned]
  • Modified Analysis by [email protected]

    Dec. 16, 2021

    Action Type Old Value New Value
    Changed Reference Type http://www.openwall.com/lists/oss-security/2021/12/15/3 No Types Assigned http://www.openwall.com/lists/oss-security/2021/12/15/3 Mailing List, Third Party Advisory
    Changed Reference Type https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf No Types Assigned https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf Third Party Advisory
    Changed Reference Type https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf No Types Assigned https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf Third Party Advisory
    Changed Reference Type https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd No Types Assigned https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd Third Party Advisory
    Changed Reference Type https://www.kb.cert.org/vuls/id/930724 No Types Assigned https://www.kb.cert.org/vuls/id/930724 Third Party Advisory, US Government Resource
    Removed CPE Configuration OR *cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
    Removed CPE Configuration OR *cpe:2.3:a:arubanetworks:silver_peak_orchestrator:-:*:*:*:*:*:*:*
    Removed CPE Configuration OR *cpe:2.3:a:siemens:capital:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:cosmos:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_consumption_control_advanced_reporting:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_consumption_control_advanced_reporting:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_consumption_control_advanced_reporting:4.0:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_consumption_control_advanced_reporting:4.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_consumption_control_advanced_reporting:4.2:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_consumption_control_advanced_reporting:5.0:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_consumption_control_advanced_reporting:5.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_consumption_control_info_center:5.0:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_consumption_control_info_center:5.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:e-car_operating_center:*:*:*:*:cloud:*:*:* versions up to (excluding) 2021-12-13 *cpe:2.3:a:siemens:energyip_prepay:3.7:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip_prepay:3.8:*:*:*:*:*:*:* *cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:* versions from (including) 8.6.2j-398 *cpe:2.3:a:siemens:head-end_system_universal_device_integration_system:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:industrial_edge_management:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:simatic_wincc:7.4:*:*:*:*:*:*:* *cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:* *cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_command:*:*:*:*:*:*:*:* versions up to (including) 4.16.2.1 *cpe:2.3:a:siemens:siveillance_control:*:*:*:*:pro:*:*:* versions up to (excluding) 2.1 *cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_vantage:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:solid_edge_wiring_harness_design:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_4:*:*:*:*:*:*:*:* versions up to (excluding) 4.70 *cpe:2.3:a:siemens:spectrum_power_4:4.70:-:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_4:4.70:sp7:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_4:4.70:sp8:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_7:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:teamcenter_suite:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:vesys:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:xpedition_enterprise_data_management:*:*:*:*:*:*:*:* versions from (including) 2.6 up to (including) 2.10 *cpe:2.3:a:siemens:xpedition_package_integrator:*:*:*:*:*:*:*:* versions from (including) 2.6 up to (including) 2.10 *cpe:2.3:o:siemens:dynamic_security_assessment:4.2:*:*:*:*:*:*:* *cpe:2.3:o:siemens:dynamic_security_assessment:4.3:*:*:*:*:*:*:* *cpe:2.3:o:siemens:dynamic_security_assessment:4.4:*:*:*:*:*:*:* *cpe:2.3:o:siemens:industrial_edge_management:-:*:*:*:*:*:*:* *cpe:2.3:o:siemens:industrial_edge_manangement_hub:-:*:*:*:*:*:*:* *cpe:2.3:o:siemens:logo\!_soft_comfort:-:*:*:*:*:*:*:* *cpe:2.3:o:siemens:mendix:-:*:*:*:*:*:*:* *cpe:2.3:o:siemens:mindsphere:*:*:*:*:cloud:*:*:* versions up to (excluding) 2021-12-11 *cpe:2.3:o:siemens:nx:-:*:*:*:*:*:*:* *cpe:2.3:o:siemens:opcenter_intelligence:*:*:*:*:*:*:*:* versions from (including) 3.2 *cpe:2.3:o:siemens:operation_scheduler:*:*:*:*:*:*:*:* versions from (including) 1.1.3
    Changed CPE Configuration OR *cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:* *cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:* *cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:* *cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:* *cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* versions from (including) 2.0.1 up to (including) 2.12.1 *cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* versions from (including) 2.13.0 up to (excluding) 2.15.0 OR *cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:* *cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:* *cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:* *cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:* *cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* versions from (including) 2.0.1 up to (excluding) 2.12.2 *cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* versions from (including) 2.13.0 up to (excluding) 2.16.0
    Changed CPE Configuration OR *cpe:2.3:a:intel:audio_development_kit:-:*:*:*:*:*:*:* *cpe:2.3:a:intel:datacenter_manager:-:*:*:*:*:*:*:* *cpe:2.3:a:intel:oneapi:-:*:*:*:*:eclipse:*:* *cpe:2.3:a:intel:secure_device_onboard:-:*:*:*:*:*:*:* *cpe:2.3:a:intel:system_debugger:-:*:*:*:*:*:*:* OR *cpe:2.3:a:intel:audio_development_kit:-:*:*:*:*:*:*:* *cpe:2.3:a:intel:computer_vision_annotation_tool:-:*:*:*:*:*:*:* *cpe:2.3:a:intel:datacenter_manager:-:*:*:*:*:*:*:* *cpe:2.3:a:intel:genomics_kernel_library:-:*:*:*:*:*:*:* *cpe:2.3:a:intel:oneapi:-:*:*:*:*:eclipse:*:* *cpe:2.3:a:intel:secure_device_onboard:-:*:*:*:*:*:*:* *cpe:2.3:a:intel:sensor_solution_firmware_development_kit:-:*:*:*:*:*:*:* *cpe:2.3:a:intel:system_debugger:-:*:*:*:*:*:*:* *cpe:2.3:a:intel:system_studio:-:*:*:*:*:*:*:*
    Changed CPE Configuration OR *cpe:2.3:a:netapp:brocade_san_navigator:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:ontap_tools:-:*:*:*:*:vmware_vsphere:*:* *cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:vmware_vsphere:*:* AND OR *cpe:2.3:o:siemens:sppa-t3000_ses3000_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:siemens:sppa-t3000_ses3000:-:*:*:*:*:*:*:*
    Changed CPE Configuration OR *cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* OR *cpe:2.3:a:siemens:captial:*:*:*:*:*:*:*:* versions up to (excluding) 2019.1 *cpe:2.3:a:siemens:captial:2019.1:-:*:*:*:*:*:* *cpe:2.3:a:siemens:captial:2019.1:sp1912:*:*:*:*:*:* *cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.0:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.2:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.0:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_info_center:5.0:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_cc_info_center:5.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:e-car_operation_center:*:*:*:*:*:*:*:* versions up to (excluding) 2021-12-13 *cpe:2.3:a:siemens:energy_engage:3.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip:8.5:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip:8.6:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip:8.7:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip:9.0:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip_prepay:3.7:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip_prepay:3.8:*:*:*:*:*:*:* *cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:* versions up to (excluding) 8.6.2j-398 *cpe:2.3:a:siemens:head-end_system_universal_device_integration_system:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:industrial_edge_management:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:industrial_edge_management_hub:*:*:*:*:*:*:*:* versions up to (excluding) 2021-12-13 *cpe:2.3:a:siemens:logo\!_soft_comfort:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:mindsphere:*:*:*:*:*:*:*:* versions up to (excluding) 2021-12-11 *cpe:2.3:a:siemens:navigator:*:*:*:*:*:*:*:* versions up to (excluding) 2021-12-13 *cpe:2.3:a:siemens:nx:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:* versions up to (including) 3.2 *cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:* versions up to (including) 1.1.3 *cpe:2.3:a:siemens:sentron_powermanager:4.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:sentron_powermanager:4.2:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siguard_dsa:4.2:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siguard_dsa:4.3:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siguard_dsa:4.4:*:*:*:*:*:*:* *cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:* *cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_command:*:*:*:*:*:*:*:* versions up to (including) 4.16.2.1 *cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_vantage:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_viewpoint:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:solid_edge_cam_pro:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:solid_edge_harness_design:*:*:*:*:*:*:*:* versions up to (excluding) 2020 *cpe:2.3:a:siemens:solid_edge_harness_design:2020:*:*:*:*:*:*:* *cpe:2.3:a:siemens:solid_edge_harness_design:2020:-:*:*:*:*:*:* *cpe:2.3:a:siemens:solid_edge_harness_design:2020:sp2002:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_4:*:*:*:*:*:*:*:* versions up to (excluding) 4.70 *cpe:2.3:a:siemens:spectrum_power_4:4.70:-:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_4:4.70:sp7:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_4:4.70:sp8:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_7:*:*:*:*:*:*:*:* versions up to (excluding) 2.30 *cpe:2.3:a:siemens:spectrum_power_7:2.30:*:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_7:2.30:-:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_7:2.30:sp2:*:*:*:*:*:* *cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:vesys:*:*:*:*:*:*:*:* versions up to (excluding) 2019.1 *cpe:2.3:a:siemens:vesys:2019.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:vesys:2019.1:-:*:*:*:*:*:* *cpe:2.3:a:siemens:vesys:2019.1:sp1912:*:*:*:*:*:* *cpe:2.3:a:siemens:xpedition_enterprise:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:xpedition_package_integrator:-:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Dec. 16, 2021

    Action Type Old Value New Value
    Added Reference https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 16, 2021

    Action Type Old Value New Value
    Added Reference https://www.kb.cert.org/vuls/id/930724 [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 16, 2021

    Action Type Old Value New Value
    Added Reference https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 15, 2021

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2021/12/15/3 [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 15, 2021

    Action Type Old Value New Value
    Added Reference https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 15, 2021

    Action Type Old Value New Value
    Changed Description It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 makes a best-effort attempt to restrict JNDI LDAP lookups to localhost by default. Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 makes a best-effort attempt to restrict JNDI LDAP lookups to localhost by default. Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
    Removed Reference http://www.openwall.com/lists/oss-security/2021/12/15/1 [No Types Assigned]
    Removed Reference https://security.netapp.com/advisory/ntap-20211215-0001/ [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 15, 2021

    Action Type Old Value New Value
    Changed Description It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property `log4j2.noFormatMsgLookup` to `true` do NOT mitigate this specific vulnerability. Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (<2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 makes a best-effort attempt to restrict JNDI LDAP lookups to localhost by default. Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
    Added Reference http://www.openwall.com/lists/oss-security/2021/12/15/1 [No Types Assigned]
    Added Reference https://security.netapp.com/advisory/ntap-20211215-0001/ [No Types Assigned]
  • Initial Analysis by [email protected]

    Dec. 15, 2021

    Action Type Old Value New Value
    Added CVSS V2 NIST (AV:N/AC:H/Au:N/C:N/I:N/A:P)
    Added CVSS V3.1 NIST AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
    Changed Reference Type http://www.openwall.com/lists/oss-security/2021/12/14/4 No Types Assigned http://www.openwall.com/lists/oss-security/2021/12/14/4 Mailing List, Mitigation, Third Party Advisory
    Changed Reference Type https://logging.apache.org/log4j/2.x/security.html No Types Assigned https://logging.apache.org/log4j/2.x/security.html Mitigation, Release Notes, Vendor Advisory
    Changed Reference Type https://www.cve.org/CVERecord?id=CVE-2021-44228 No Types Assigned https://www.cve.org/CVERecord?id=CVE-2021-44228 Not Applicable
    Changed Reference Type https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html No Types Assigned https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html Third Party Advisory
    Added CWE NIST CWE-502
    Added CPE Configuration OR *cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:* *cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:* *cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:* *cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:* *cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* versions from (including) 2.0.1 up to (including) 2.12.1 *cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* versions from (including) 2.13.0 up to (excluding) 2.15.0
    Added CPE Configuration OR *cpe:2.3:a:intel:audio_development_kit:-:*:*:*:*:*:*:* *cpe:2.3:a:intel:datacenter_manager:-:*:*:*:*:*:*:* *cpe:2.3:a:intel:oneapi:-:*:*:*:*:eclipse:*:* *cpe:2.3:a:intel:secure_device_onboard:-:*:*:*:*:*:*:* *cpe:2.3:a:intel:system_debugger:-:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:netapp:brocade_san_navigator:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:ontap_tools:-:*:*:*:*:vmware_vsphere:*:* *cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:vmware_vsphere:*:*
    Added CPE Configuration OR *cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:arubanetworks:silver_peak_orchestrator:-:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:siemens:capital:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:cosmos:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_consumption_control_advanced_reporting:*:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_consumption_control_advanced_reporting:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_consumption_control_advanced_reporting:4.0:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_consumption_control_advanced_reporting:4.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_consumption_control_advanced_reporting:4.2:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_consumption_control_advanced_reporting:5.0:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_consumption_control_advanced_reporting:5.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_consumption_control_info_center:5.0:*:*:*:*:*:*:* *cpe:2.3:a:siemens:desigo_consumption_control_info_center:5.1:*:*:*:*:*:*:* *cpe:2.3:a:siemens:e-car_operating_center:*:*:*:*:cloud:*:*:* versions up to (excluding) 2021-12-13 *cpe:2.3:a:siemens:energyip_prepay:3.7:*:*:*:*:*:*:* *cpe:2.3:a:siemens:energyip_prepay:3.8:*:*:*:*:*:*:* *cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:* versions from (including) 8.6.2j-398 *cpe:2.3:a:siemens:head-end_system_universal_device_integration_system:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:industrial_edge_management:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:simatic_wincc:7.4:*:*:*:*:*:*:* *cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:* *cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_command:*:*:*:*:*:*:*:* versions up to (including) 4.16.2.1 *cpe:2.3:a:siemens:siveillance_control:*:*:*:*:pro:*:*:* versions up to (excluding) 2.1 *cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:* *cpe:2.3:a:siemens:siveillance_vantage:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:solid_edge_wiring_harness_design:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_4:*:*:*:*:*:*:*:* versions up to (excluding) 4.70 *cpe:2.3:a:siemens:spectrum_power_4:4.70:-:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_4:4.70:sp7:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_4:4.70:sp8:*:*:*:*:*:* *cpe:2.3:a:siemens:spectrum_power_7:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:teamcenter_suite:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:vesys:-:*:*:*:*:*:*:* *cpe:2.3:a:siemens:xpedition_enterprise_data_management:*:*:*:*:*:*:*:* versions from (including) 2.6 up to (including) 2.10 *cpe:2.3:a:siemens:xpedition_package_integrator:*:*:*:*:*:*:*:* versions from (including) 2.6 up to (including) 2.10 *cpe:2.3:o:siemens:dynamic_security_assessment:4.2:*:*:*:*:*:*:* *cpe:2.3:o:siemens:dynamic_security_assessment:4.3:*:*:*:*:*:*:* *cpe:2.3:o:siemens:dynamic_security_assessment:4.4:*:*:*:*:*:*:* *cpe:2.3:o:siemens:industrial_edge_management:-:*:*:*:*:*:*:* *cpe:2.3:o:siemens:industrial_edge_manangement_hub:-:*:*:*:*:*:*:* *cpe:2.3:o:siemens:logo\!_soft_comfort:-:*:*:*:*:*:*:* *cpe:2.3:o:siemens:mendix:-:*:*:*:*:*:*:* *cpe:2.3:o:siemens:mindsphere:*:*:*:*:cloud:*:*:* versions up to (excluding) 2021-12-11 *cpe:2.3:o:siemens:nx:-:*:*:*:*:*:*:* *cpe:2.3:o:siemens:opcenter_intelligence:*:*:*:*:*:*:*:* versions from (including) 3.2 *cpe:2.3:o:siemens:operation_scheduler:*:*:*:*:*:*:*:* versions from (including) 1.1.3
  • CVE Modified by [email protected]

    Dec. 15, 2021

    Action Type Old Value New Value
    Added Reference https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html [No Types Assigned]
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2021-45046 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2021-45046 weaknesses.

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

97.29 }} -0.01%

score

0.99899

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: