CVE-2021-45046

Katalog CVE

CVSS 9.0 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 100,0%

Kerentanan Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') pada apache log4j, cvat computer vision annotation tool +37 lainnya. Skor CVSS 3.1 9.0 (Critical) menurut NVD. Masuk katalog KEV CISA pada 1 Mei 2023, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

Rincian

Terbit di NVD

14 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

EPSS (30 hari)

100,0% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Apache Log4j2 Deserialization of Untrusted Data Vulnerability

Masuk KEV

1 Mei 2023

Tenggat CISA

22 Mei 2023 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 87 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://logging.apache.org/log4j/2.x/security.html mitigasi · release notes · advisory vendor
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/12/14/4 mailing list · mitigasi · advisory pihak ketiga
• https://www.kb.cert.org/vuls/id/930724 advisory pihak ketiga · pemerintah AS
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45046 pemerintah AS
• http://www.openwall.com/lists/oss-security/2021/12/15/3 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/12/18/1 mailing list · advisory pihak ketiga
• https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf advisory pihak ketiga
• https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf advisory pihak ketiga
• https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf advisory pihak ketiga
• https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf advisory pihak ketiga
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 advisory pihak ketiga
• https://security.gentoo.org/glsa/202310-16 advisory pihak ketiga
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-5022 advisory pihak ketiga
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html advisory pihak ketiga
• https://www.oracle.com/security-alerts/alert-cve-2021-44228.html advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuapr2022.html advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2022.html advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBB... mailing list · release notes
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2X... mailing list · release notes
• https://www.cve.org/CVERecord?id=CVE-2021-44228 not applicable