CVEvulnerability

CVE-2021-44832

6.6 MEDIUM Published 2021-12-28 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-12-28
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.6 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.6 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
8.5 HIGH — AV:N/AC:M/Au:S/C:C/I:C/A:C
Weaknesses
CWE-20, CWE-74

Description

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

Affected configurations

• apache log4j (>= 2.0.1 < 2.3.2) • apache log4j (>= 2.4 < 2.12.4) • apache log4j (>= 2.13.0 < 2.17.1) • apache log4j 2.0 • oracle communications diameter signaling router (>= 8.0.0.0 <= 8.5.1.0) • oracle communications interactive session recorder 6.3 • oracle communications interactive session recorder 6.4 • oracle primavera gateway (>= 17.12.0 <= 17.12.11) • oracle primavera gateway (>= 18.8.0 <= 18.8.13) • oracle primavera gateway (>= 19.12.0 <= 19.12.12) • oracle primavera gateway (>= 20.12.0 <= 20.12.7) • oracle primavera gateway 21.12.0 • oracle primavera p6 enterprise project portfolio management (>= 19.12.0 <= 19.12.18.0) • oracle primavera p6 enterprise project portfolio management (>= 20.12.0.0 <= 20.12.12.0) • oracle primavera p6 enterprise project portfolio management 21.12.0.0 • oracle primavera unifier 18.8 • oracle primavera unifier 19.12 • oracle primavera unifier 20.12 • oracle primavera unifier 21.12 • oracle retail assortment planning 16.0.3 • oracle retail fiscal management 14.2 • oracle siebel ui framework 21.12 • oracle weblogic server 12.2.1.3.0 • oracle weblogic server 12.2.1.4.0 • oracle weblogic server 14.1.1.0.0 • cisco cloudcenter 4.10.0.16 • fedoraproject fedora 34 • fedoraproject fedora 35 • debian debian linux 9.0 • oracle communications brm - elastic charging engine (< 12.0.0.4.6) • oracle communications brm - elastic charging engine 12.0.0.5.0 • oracle communications diameter signaling router (>= 8.3.0.0 <= 8.5.1.0) • oracle communications offline mediation controller (< 12.0.0.4.4) • oracle communications offline mediation controller 12.0.0.5.0 • oracle flexcube private banking 12.1.0 • oracle health sciences data management workbench 2.5.2.1 • oracle health sciences data management workbench 3.0.0.0 • oracle health sciences data management workbench 3.1.0.3 • oracle policy automation (>= 12.2.0 <= 12.2.24) • oracle policy automation for mobile devices (>= 12.2.0 <= 12.2.24) • oracle primavera p6 enterprise project portfolio management (>= 19.12.0.0 <= 19.12.18.0) • oracle product lifecycle analytics 3.6.1 • oracle retail order broker 18.0 • oracle retail order broker 19.1 • oracle retail xstore point of service 17.0.4 • oracle retail xstore point of service 18.0.3 • oracle retail xstore point of service 19.0.2 • oracle retail xstore point of service 20.0.1 • oracle retail xstore point of service 21.0.1 • oracle siebel ui framework (<= 21.12)

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References