{"id":"CVE-2021-44832","published":"2021-12-28T19:35:11Z","modified":"2026-05-29T18:53:46Z","title":"Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration","vendor":"Apache Software Foundation","product":"Apache Log4j2","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Log4j2","versions":[">= log4j-core, < 2.17.1"]}],"description":{"text":"Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.","provenance":"source","from":"CVE.org"},"summary":{"text":"Apache Log4j2, from the Apache Software Foundation, contains a flaw in its JDBC Appender where a JNDI LDAP data source URI in the logging configuration is processed without adequate validation. An attacker who controls the target LDAP server can achieve remote code execution, but only when the configuration uses a JDBC Appender with such a JNDI LDAP data source, and the affected versions span 2.0-beta7 through 2.17.0, excluding the security fix releases 2.3.2 and 2.12.4.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:28Z"},"cvss":{"score":6.6,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.97906,"percentile":0.99908,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-02-14","exploitedFirstSeen":"2023-02-14","ransomware":true,"evidence":[{"url":"https://info.securin.io/hubfs/Securin%20Ransomware%20Report%202023.pdf","date":"2023-02-14"},{"url":"https://www.securin.io/wp-content/uploads/2023/08/2023-State-of-Cybersecurity-for-Medical-Devices-and-Healthcare-Systems.pdf","date":"2023-08-08"},{"url":"https://www.ptsecurity.com/ww-en/analytics/apt-groups-in-the-middle-east/","date":"2024-03-27"},{"url":"https://securityaffairs.com/163984/hacking/critical-apache-log4j2-flaw-still-threatens-global-finance.html","date":"2024-06-01"},{"url":"https://pt-global.storage.yandexcloud.net/positive_research_2024_a9c4fb10c2.pdf","date":"2024-10-16"},{"url":"https://blog.talosintelligence.com/content/files/2025/03/2024YiR-report.pdf","date":"2025-03-31"},{"url":"https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/files/2026/03/2025YiR-report.pdf","date":"2026-03-23"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":29,"pulses":[{"name":"APT29","url":"https://otx.alienvault.com/pulse/69f46a108000bd36fe90d5be","created":"2026-05-01"},{"name":"dfirfanatic_IOC's","url":"https://otx.alienvault.com/pulse/67e4c1dd7b36e6d82df4d612","created":"2025-03-27"},{"name":"How APT groups operate in the Middle East - May 2024","url":"https://otx.alienvault.com/pulse/66470d32f3d41765c5c976f9","created":"2024-05-17"},{"name":"How APT groups operate in the Middle East","url":"https://otx.alienvault.com/pulse/660e22c6ac6105fec7bcc159","created":"2024-04-04"},{"name":"ACTUALIZACION | Oracle Critical Patch Update Advisory - July 2023","url":"https://otx.alienvault.com/pulse/64bace8d5d470a6a7baaa8a9","created":"2023-07-21"},{"name":"ACTUALIZACION | A vulnerability in Apache Log4j affects some features of IBM® Db2®  (CVE-2021-44832)","url":"https://otx.alienvault.com/pulse/636fcfb1c098948655446dd5","created":"2022-11-12"},{"name":"Cisco Talos Intelligence Group - Comprehensive Threat Intelligence: Avos ransomware group expands with new attack arsenal","url":"https://otx.alienvault.com/pulse/62cbba438824f6c661c84995","created":"2022-07-11"},{"name":"Avos Ransomware Group Expands Attack Arsenal to VMware Horizon Access Gateways","url":"https://otx.alienvault.com/pulse/62bb9691168d324fb3511255","created":"2022-06-29"},{"name":"Cisco Talos Intelligence Group - Comprehensive Threat Intelligence: Avos ransomware group expands with new attack arsenal","url":"https://otx.alienvault.com/pulse/62b2e664239bab694df94cfd","created":"2022-06-22"},{"name":"Avos Ransomware Group Expands Attack Arsenal to VMware Horizon Access Gateways","url":"https://otx.alienvault.com/pulse/62b290cadc0ccfc853312064","created":"2022-06-22"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"},{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component"}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","tags":["vendor-advisory","x_refsource_CISCO"]},{"url":"https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143","tags":["x_refsource_MISC"]},{"url":"https://issues.apache.org/jira/browse/LOG4J2-3293","tags":["x_refsource_MISC"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/28/1","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00036.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20220104-0001/","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote attacker exploits Log4j2 application over network","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"remote code execution (RCE) attack when a configuration uses a JDBC Appender","start":119,"end":195}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary code execution via JNDI lookup","mappingType":"primary_impact","evidence":[{"from":"description","quote":"remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP","start":119,"end":212}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-e030a140d352155c7a50","title":"RaaS AvosLocker Incident Response Analysis","publisher":"linkedin.com","url":"https://www.linkedin.com/pulse/raas-avoslocker-incident-response-analysis-fl%C3%A1vio-costa?trk=articles_directory","date":null,"mentions":[{"quote":"vulnerabilities associated to Log4J were found on the VMWare Horizon Unified Access Gateways, UAG01 and UAG02, those were CVE-2021-44228 / CVE-2021-45046 / CVE-2021-45105 / CVE-2021-44832, which can potentially allow remote code execution on Unified Access Gateway by the low privilege non-root user named","start":2373,"end":2678}]}],"affected":[{"ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","vulnerableRanges":[">=2.0-beta7, <2.3.2",">=2.4, <2.12.4",">=2.13.0, <2.17.1"],"patched":["2.3.2","2.12.4","2.17.1"],"from":["GHSA-8489-44mv-ggj8"],"provenance":"source"},{"ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","vulnerableRanges":[">=1.8.0, <1.9.2",">=1.10.0, <1.10.9",">=1.11.0, <1.11.13",">=2.0.0, <2.0.14"],"patched":["1.9.2","1.10.9","1.11.13","2.0.14"],"from":["GHSA-8489-44mv-ggj8"],"provenance":"source"}],"advisories":[{"id":"GHSA-8489-44mv-ggj8","url":"https://github.com/advisories/GHSA-8489-44mv-ggj8","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","vulnerableRanges":[">=2.0-beta7, <2.3.2"],"patched":["2.3.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-8489-44mv-ggj8","url":"https://github.com/advisories/GHSA-8489-44mv-ggj8","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","vulnerableRanges":[">=2.4, <2.12.4"],"patched":["2.12.4"],"provenance":"source","from":"GHSA"},{"id":"GHSA-8489-44mv-ggj8","url":"https://github.com/advisories/GHSA-8489-44mv-ggj8","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","vulnerableRanges":[">=2.13.0, <2.17.1"],"patched":["2.17.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-8489-44mv-ggj8","url":"https://github.com/advisories/GHSA-8489-44mv-ggj8","severity":"MODERATE","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","vulnerableRanges":[">=1.8.0, <1.9.2"],"patched":["1.9.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-8489-44mv-ggj8","url":"https://github.com/advisories/GHSA-8489-44mv-ggj8","severity":"MODERATE","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","vulnerableRanges":[">=1.10.0, <1.10.9"],"patched":["1.10.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-8489-44mv-ggj8","url":"https://github.com/advisories/GHSA-8489-44mv-ggj8","severity":"MODERATE","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","vulnerableRanges":[">=1.11.0, <1.11.13"],"patched":["1.11.13"],"provenance":"source","from":"GHSA"},{"id":"GHSA-8489-44mv-ggj8","url":"https://github.com/advisories/GHSA-8489-44mv-ggj8","severity":"MODERATE","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","vulnerableRanges":[">=2.0.0, <2.0.14"],"patched":["2.0.14"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-0516","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0516","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2021-12-29","earliestUrl":"https://github.com/cckuailong/log4j_RCE_CVE-2021-44832","repos":[{"name":"cckuailong/log4j_RCE_CVE-2021-44832","url":"https://github.com/cckuailong/log4j_RCE_CVE-2021-44832","stars":4,"created":"2021-12-29"},{"name":"name/log4j-scanner","url":"https://github.com/name/log4j-scanner","stars":1,"created":"2021-12-29"}]},"first":{"date":"2021-12-29","source":"PoC-in-GitHub","url":"https://github.com/cckuailong/log4j_RCE_CVE-2021-44832"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2021-12-28","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-44832","provenance":"source"},{"date":"2021-12-29","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/cckuailong/log4j_RCE_CVE-2021-44832","provenance":"source"},{"date":"2023-02-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://info.securin.io/hubfs/Securin%20Ransomware%20Report%202023.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":81.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1353 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9991"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"29 pulses"},{"name":"CVSS severity","points":4.62,"detail":"base score 6.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2021-44228","published":"2021-12-10","fixed":"2.15.0","kev":true},{"cve":"CVE-2021-45046","published":"2021-12-14","fixed":"2.16.0","kev":true,"link":{"from":"CVE-2021-45046","to":"CVE-2021-44832","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.ops4j.pax.logging:pax-logging-log4j2","fromFixed":"1.10.8","toFixed":"1.10.9","daysApart":14}]}},{"cve":"CVE-2021-45105","published":"2021-12-18","fixed":"2.17.0","kev":false,"link":{"from":"CVE-2021-45105","to":"CVE-2021-44832","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.logging.log4j:log4j-core","fromFixed":"2.3.1","toFixed":"2.3.2","daysApart":10},{"kind":"version-step","provenance":"source","package":"Maven:org.ops4j.pax.logging:pax-logging-log4j2","fromFixed":"1.11.12","toFixed":"1.11.13","daysApart":10},{"kind":"similar","provenance":"machine","score":0.3,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2021-44832","published":"2021-12-28","fixed":"2.17.1","kev":false},{"cve":"CVE-2025-68161","published":"2025-12-18","fixed":"2.25.3","kev":false},{"cve":"CVE-2026-34477","published":"2026-04-10","fixed":"2.25.4","kev":false},{"cve":"CVE-2026-34478","published":"2026-04-10","fixed":"2.25.4","kev":false}],"package":"Maven:org.apache.logging.log4j:log4j-core"}}