7.5

CVE-2021-4104

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Data is provided by the National Vulnerability Database (NVD)
Apache ≫ Log4j Version1.2
Fedoraproject ≫ Fedora Version35
Redhat ≫ Codeready Studio Version12.0
Redhat ≫ Jboss A-mq Version6.0.0
Redhat ≫ Jboss A-mq Version7
Redhat ≫ Jboss Data Grid Version7.0.0
Redhat ≫ Jboss Fuse Version6.0.0
Redhat ≫ Jboss Fuse Version7.0.0
Redhat ≫ Jboss Web Server Version3.0
Redhat ≫ Process Automation Version7.0
Redhat ≫ Single Sign-on Version7.0
Redhat ≫ Enterprise Linux Version6.0
Redhat ≫ Enterprise Linux Version7.0
Redhat ≫ Enterprise Linux Version8.0
Oracle ≫ Business Intelligence Version5.9.0.0.0 SwEditionenterprise
Oracle ≫ Business Intelligence Version12.2.1.3.0 SwEditionenterprise
Oracle ≫ Business Intelligence Version12.2.1.4.0 SwEditionenterprise
Oracle ≫ Goldengate Version-
Oracle ≫ Identity Management Suite Version12.2.1.3.0
Oracle ≫ Identity Management Suite Version12.2.1.4.0
Oracle ≫ Jdeveloper Version12.2.1.3.0
Oracle ≫ Mysql Enterprise Monitor Version <= 8.0.29
Oracle ≫ Retail Allocation Version14.1.3.2
Oracle ≫ Retail Allocation Version15.0.3.1
Oracle ≫ Retail Allocation Version16.0.3
Oracle ≫ Retail Allocation Version19.0.1
Oracle ≫ Stream Analytics Version-
Oracle ≫ Timesten Grid Version-
Oracle ≫ Tuxedo Version12.2.2.0.0
Oracle ≫ Utilities Testing Accelerator Version6.0.0.1.1
Oracle ≫ Utilities Testing Accelerator Version6.0.0.2.2
Oracle ≫ Utilities Testing Accelerator Version6.0.0.3.1
Oracle ≫ Weblogic Server Version12.2.1.3.0
Oracle ≫ Weblogic Server Version12.2.1.4.0
Oracle ≫ Weblogic Server Version14.1.1.0.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 72.2% 0.987
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6 6.8 6.4
AV:N/AC:M/Au:S/C:P/I:P/A:P
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.