CVEvulnerability

CVE-2021-4104

7.5 HIGH Published 2021-12-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-12-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
Weaknesses
CWE-502

Description

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Affected configurations

• apache log4j 1.2 • fedoraproject fedora 35 • redhat codeready studio 12.0 • redhat integration camel k • redhat integration camel quarkus • redhat jboss a-mq 6.0.0 • redhat jboss a-mq 7 • redhat jboss a-mq streaming • redhat jboss data grid 7.0.0 • redhat jboss data virtualization 6.0.0 • redhat jboss enterprise application platform 6.0.0 • redhat jboss enterprise application platform 7.0 • redhat jboss fuse 6.0.0 • redhat jboss fuse 7.0.0 • redhat jboss fuse service works 6.0 • redhat jboss operations network 3.0 • redhat jboss web server 3.0 • redhat openshift application runtimes • redhat openshift container platform 4.6 • redhat openshift container platform 4.7 • redhat openshift container platform 4.8 • redhat process automation 7.0 • redhat single sign-on 7.0 • redhat software collections • redhat enterprise linux 6.0 • redhat enterprise linux 7.0 • redhat enterprise linux 8.0 • oracle advanced supply chain planning 12.1 • oracle advanced supply chain planning 12.2 • oracle business intelligence 5.9.0.0.0 • oracle business intelligence 12.2.1.3.0 • oracle business intelligence 12.2.1.4.0 • oracle business process management suite 12.2.1.3.0 • oracle business process management suite 12.2.1.4.0 • oracle communications eagle ftp table base retrieval 4.5 • oracle communications messaging server 8.1 • oracle communications network integrity 7.3.6 • oracle communications offline mediation controller (< 12.0.0.4.0) • oracle communications offline mediation controller 12.0.0.5.0 • oracle communications unified inventory management 7.3.4 • oracle communications unified inventory management 7.3.5 • oracle communications unified inventory management 7.4.1 • oracle communications unified inventory management 7.4.2 • oracle e-business suite cloud manager and cloud backup module 2.2.1.1.1 • oracle enterprise manager base platform 13.4.0.0 • oracle enterprise manager base platform 13.5.0.0 • oracle financial services revenue management and billing analytics 2.7.0.0 • oracle financial services revenue management and billing analytics 2.7.0.1 • oracle financial services revenue management and billing analytics 2.8.0.0 • oracle fusion middleware common libraries and tools 12.2.1.4.0 • oracle goldengate • oracle healthcare data repository 8.1.0 • oracle hyperion data relationship management (< 11.2.8.0) • oracle hyperion infrastructure technology (< 11.2.8.0) • oracle identity management suite 12.2.1.3.0 • oracle identity management suite 12.2.1.4.0 • oracle jdeveloper 12.2.1.3.0 • oracle mysql enterprise monitor (<= 8.0.29) • oracle retail allocation 14.1.3.2 • oracle retail allocation 15.0.3.1 … and 12 more

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References