CVEvulnerability

CVE-2021-44228

10.0 CRITICAL Known exploited Published 2021-12-10 Modified 2026-08-11 Official page ↗

CISA Known Exploited Vulnerability

Apache Log4j2 Remote Code Execution Vulnerability — Apache Log4j2

Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

Added to KEV
2021-12-10
Remediation due
2021-12-24
Ransomware use
Known
Required action
For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2021-44228
Status
Analyzed
Published
2021-12-10
Last modified
2026-08-11
Assigner
[email protected]
CVSS 3.1 ([email protected])
10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-20, CWE-400, CWE-502, CWE-917

Description

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Affected configurations

• siemens 6bk1602-0aa12-0tp0 firmware (< 2.7.0) • siemens 6bk1602-0aa22-0tp0 firmware (< 2.7.0) • siemens 6bk1602-0aa32-0tp0 firmware (< 2.7.0) • siemens 6bk1602-0aa42-0tp0 firmware (< 2.7.0) • siemens 6bk1602-0aa52-0tp0 firmware (< 2.7.0) • apache log4j (>= 2.0.1 < 2.3.1) • apache log4j (>= 2.4.0 < 2.12.2) • apache log4j (>= 2.13.0 < 2.15.0) • apache log4j 2.0 • siemens sppa-t3000 ses3000 firmware • siemens capital (< 2019.1) • siemens capital 2019.1 • siemens comos (< 10.4.2) • siemens desigo cc advanced reports 3.0 • siemens desigo cc advanced reports 4.0 • siemens desigo cc advanced reports 4.1 • siemens desigo cc advanced reports 4.2 • siemens desigo cc advanced reports 5.0 • siemens desigo cc advanced reports 5.1 • siemens desigo cc info center 5.0 • siemens desigo cc info center 5.1 • siemens e-car operation center (< 2021-12-13) • siemens energy engage 3.1 • siemens energyip 8.5 • siemens energyip 8.6 • siemens energyip 8.7 • siemens energyip 9.0 • siemens energyip prepay (< 3.8.0.12) • siemens gma-manager (< 8.6.2j-398) • siemens head-end system universal device integration system • siemens industrial edge management • siemens industrial edge management hub (< 2021-12-13) • siemens logo\! soft comfort • siemens mendix • siemens mindsphere (< 2021-12-16) • siemens navigator (< 2021-12-13) • siemens nx • siemens opcenter intelligence (>= 3.2 < 3.5) • siemens operation scheduler (<= 1.1.3) • siemens sentron powermanager 4.1 • siemens sentron powermanager 4.2 • siemens siguard dsa (>= 4.2 < 4.4.1) • siemens sipass integrated 2.80 • siemens sipass integrated 2.85 • siemens siveillance command (<= 4.16.2.1) • siemens siveillance control pro • siemens siveillance identity 1.5 • siemens siveillance identity 1.6 • siemens siveillance vantage • siemens siveillance viewpoint • siemens solid edge cam pro • siemens solid edge harness design (< 2020) • siemens solid edge harness design 2020 • siemens spectrum power 4 (< 4.70) • siemens spectrum power 4 4.70 • siemens spectrum power 7 (< 2.30) • siemens spectrum power 7 2.30 • siemens teamcenter • siemens vesys (< 2019.1) • siemens vesys 2019.1 … and 273 more

Related

Weakness · CWE (4)

  • CWE-20 Improper Input Validation weakness
  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-502 Deserialization of Untrusted Data weakness
  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement weakness

Referenced by CWE · observed example (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement weakness

References