CVE-2021-44228

Katalog CVE

CVSS 10.0 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 100,0%

Kerentanan Improper Input Validation pada siemens 6bk1602-0aa12-0tp0 firmware, siemens 6bk1602-0aa22-0tp0 firmware +35 lainnya. Skor CVSS 3.1 10.0 (Critical) menurut NVD. Masuk katalog KEV CISA pada 10 Desember 2021, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Rincian

Terbit di NVD

10 Desember 2021

Terakhir diubah

11 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-400: Uncontrolled Resource Consumption
CWE-502: Deserialization of Untrusted Data
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

EPSS (30 hari)

100,0% peluang dieksploitasi; lebih tinggi dari 100,0% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Apache Log4j2 Remote Code Execution Vulnerability

Masuk KEV

10 Desember 2021

Tenggat CISA

24 Desember 2021 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 360 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://logging.apache.org/log4j/2.x/security.html release notes · advisory vendor
• https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/ patch · advisory pihak ketiga · advisory vendor
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/12/10/1 mailing list · mitigasi · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/12/10/2 mailing list · mitigasi · advisory pihak ketiga
• https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md broken link · product · pemerintah AS
• https://www.kb.cert.org/vuls/id/930724 advisory pihak ketiga · pemerintah AS
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228 advisory pihak ketiga · pemerintah AS
• http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html broken link · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Rem... exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Ex... exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injecti... advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html advisory pihak ketiga · vdb entry