CVE
CVE-2021-4104
- First Reported
- Dec 21, 2021
- Latest Reported
- Dec 21, 2021
CVE Enrichment
- CVSS
- 7.5 HIGH
- EPSS
- 80.60%
- EPSS Percentile
- 99.62%
- CISA KEV
- Not listed
Description
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- security@apache.org
- Published
- 14-Dec-2021 19:15
- Last Modified
- 17-Jun-2026 11:19
- EPSS Date
- 2026-10-19
- CWE
- CWE-502
CVSS Vector
CVSS:3.1 AV:N /
AC:H /
PR:L /
UI:N /
S:U /
C:H /
I:H /
A:H
Affected Products / Versions
- apache / log4j
Version / affected range: 1.2
cpe:2.3:a:apache:log4j:1.2:*:*:*:*:*:*:* - fedoraproject / fedora
Version / affected range: 35
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* - redhat / codeready_studio
Version / affected range: 12.0
cpe:2.3:a:redhat:codeready_studio:12.0:*:*:*:*:*:*:* - redhat / integration_camel_k
Version / affected range: -
cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:* - redhat / integration_camel_quarkus
Version / affected range: -
cpe:2.3:a:redhat:integration_camel_quarkus:-:*:*:*:*:*:*:* - redhat / jboss_a-mq
Version / affected range: 6.0.0
cpe:2.3:a:redhat:jboss_a-mq:6.0.0:*:*:*:*:*:*:* - redhat / jboss_a-mq
Version / affected range: 7
cpe:2.3:a:redhat:jboss_a-mq:7:*:*:*:*:*:*:* - redhat / jboss_a-mq_streaming
Version / affected range: -
cpe:2.3:a:redhat:jboss_a-mq_streaming:-:*:*:*:*:*:*:* - redhat / jboss_data_grid
Version / affected range: 7.0.0
cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:* - redhat / jboss_data_virtualization
Version / affected range: 6.0.0
cpe:2.3:a:redhat:jboss_data_virtualization:6.0.0:*:*:*:*:*:*:* - redhat / jboss_enterprise_application_platform
Version / affected range: 6.0.0
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* - redhat / jboss_enterprise_application_platform
Version / affected range: 7.0
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:* - redhat / jboss_fuse
Version / affected range: 6.0.0
cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:* - redhat / jboss_fuse
Version / affected range: 7.0.0
cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:* - redhat / jboss_fuse_service_works
Version / affected range: 6.0
cpe:2.3:a:redhat:jboss_fuse_service_works:6.0:*:*:*:*:*:*:* - redhat / jboss_operations_network
Version / affected range: 3.0
cpe:2.3:a:redhat:jboss_operations_network:3.0:*:*:*:*:*:*:* - redhat / jboss_web_server
Version / affected range: 3.0
cpe:2.3:a:redhat:jboss_web_server:3.0:*:*:*:*:*:*:* - redhat / openshift_application_runtimes
Version / affected range: -
cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:* - redhat / openshift_container_platform
Version / affected range: 4.6
cpe:2.3:a:redhat:openshift_container_platform:4.6:*:*:*:*:*:*:* - redhat / openshift_container_platform
Version / affected range: 4.7
cpe:2.3:a:redhat:openshift_container_platform:4.7:*:*:*:*:*:*:* - redhat / openshift_container_platform
Version / affected range: 4.8
cpe:2.3:a:redhat:openshift_container_platform:4.8:*:*:*:*:*:*:* - redhat / process_automation
Version / affected range: 7.0
cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* - redhat / single_sign-on
Version / affected range: 7.0
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* - redhat / software_collections
Version / affected range: -
cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* - redhat / enterprise_linux
Version / affected range: 6.0
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* - redhat / enterprise_linux
Version / affected range: 7.0
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* - redhat / enterprise_linux
Version / affected range: 8.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* - oracle / advanced_supply_chain_planning
Version / affected range: 12.1
cpe:2.3:a:oracle:advanced_supply_chain_planning:12.1:*:*:*:*:*:*:* - oracle / advanced_supply_chain_planning
Version / affected range: 12.2
cpe:2.3:a:oracle:advanced_supply_chain_planning:12.2:*:*:*:*:*:*:* - oracle / business_intelligence
Version / affected range: 5.9.0.0.0
cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:* - oracle / business_intelligence
Version / affected range: 12.2.1.3.0
cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* - oracle / business_intelligence
Version / affected range: 12.2.1.4.0
cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* - oracle / business_process_management_suite
Version / affected range: 12.2.1.3.0
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* - oracle / business_process_management_suite
Version / affected range: 12.2.1.4.0
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:* - oracle / communications_eagle_ftp_table_base_retrieval
Version / affected range: 4.5
cpe:2.3:a:oracle:communications_eagle_ftp_table_base_retrieval:4.5:*:*:*:*:*:*:* - oracle / communications_messaging_server
Version / affected range: 8.1
cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* - oracle / communications_network_integrity
Version / affected range: 7.3.6
cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:* - oracle / communications_offline_mediation_controller
Version / affected range: * · before (exclusive) 12.0.0.4.0
cpe:2.3:a:oracle:communications_offline_mediation_controller:*:*:*:*:*:*:*:* - oracle / communications_offline_mediation_controller
Version / affected range: 12.0.0.5.0
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.5.0:*:*:*:*:*:*:* - oracle / communications_unified_inventory_management
Version / affected range: 7.3.4
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:* - oracle / communications_unified_inventory_management
Version / affected range: 7.3.5
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:* - oracle / communications_unified_inventory_management
Version / affected range: 7.4.1
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* - oracle / communications_unified_inventory_management
Version / affected range: 7.4.2
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:* - oracle / e-business_suite_cloud_manager_and_cloud_backup_module
Version / affected range: 2.2.1.1.1
cpe:2.3:a:oracle:e-business_suite_cloud_manager_and_cloud_backup_module:2.2.1.1.1:*:*:*:*:*:*:* - oracle / enterprise_manager_base_platform
Version / affected range: 13.4.0.0
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* - oracle / enterprise_manager_base_platform
Version / affected range: 13.5.0.0
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:* - oracle / financial_services_revenue_management_and_billing_analytics
Version / affected range: 2.7.0.0
cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7.0.0:*:*:*:*:*:*:* - oracle / financial_services_revenue_management_and_billing_analytics
Version / affected range: 2.7.0.1
cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7.0.1:*:*:*:*:*:*:* - oracle / financial_services_revenue_management_and_billing_analytics
Version / affected range: 2.8.0.0
cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8.0.0:*:*:*:*:*:*:* - oracle / fusion_middleware_common_libraries_and_tools
Version / affected range: 12.2.1.4.0
cpe:2.3:a:oracle:fusion_middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:* - oracle / goldengate
Version / affected range: -
cpe:2.3:a:oracle:goldengate:-:*:*:*:*:*:*:* - oracle / healthcare_data_repository
Version / affected range: 8.1.0
cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:*:* - oracle / hyperion_data_relationship_management
Version / affected range: * · before (exclusive) 11.2.8.0
cpe:2.3:a:oracle:hyperion_data_relationship_management:*:*:*:*:*:*:*:* - oracle / hyperion_infrastructure_technology
Version / affected range: * · before (exclusive) 11.2.8.0
cpe:2.3:a:oracle:hyperion_infrastructure_technology:*:*:*:*:*:*:*:* - oracle / identity_management_suite
Version / affected range: 12.2.1.3.0
cpe:2.3:a:oracle:identity_management_suite:12.2.1.3.0:*:*:*:*:*:*:* - oracle / identity_management_suite
Version / affected range: 12.2.1.4.0
cpe:2.3:a:oracle:identity_management_suite:12.2.1.4.0:*:*:*:*:*:*:* - oracle / jdeveloper
Version / affected range: 12.2.1.3.0
cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* - oracle / mysql_enterprise_monitor
Version / affected range: * · through (inclusive) 8.0.29
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* - oracle / retail_allocation
Version / affected range: 14.1.3.2
cpe:2.3:a:oracle:retail_allocation:14.1.3.2:*:*:*:*:*:*:* - oracle / retail_allocation
Version / affected range: 15.0.3.1
cpe:2.3:a:oracle:retail_allocation:15.0.3.1:*:*:*:*:*:*:* - oracle / retail_allocation
Version / affected range: 16.0.3
cpe:2.3:a:oracle:retail_allocation:16.0.3:*:*:*:*:*:*:* - oracle / retail_allocation
Version / affected range: 19.0.1
cpe:2.3:a:oracle:retail_allocation:19.0.1:*:*:*:*:*:*:* - oracle / retail_extract_transform_and_load
Version / affected range: 13.2.5
cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.5:*:*:*:*:*:*:* - oracle / stream_analytics
Version / affected range: -
cpe:2.3:a:oracle:stream_analytics:-:*:*:*:*:*:*:* - oracle / timesten_grid
Version / affected range: -
cpe:2.3:a:oracle:timesten_grid:-:*:*:*:*:*:*:* - oracle / tuxedo
Version / affected range: 12.2.2.0.0
cpe:2.3:a:oracle:tuxedo:12.2.2.0.0:*:*:*:*:*:*:* - oracle / utilities_testing_accelerator
Version / affected range: 6.0.0.1.1
cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:* - oracle / utilities_testing_accelerator
Version / affected range: 6.0.0.2.2
cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:* - oracle / utilities_testing_accelerator
Version / affected range: 6.0.0.3.1
cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:* - oracle / weblogic_server
Version / affected range: 12.2.1.3.0
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* - oracle / weblogic_server
Version / affected range: 12.2.1.4.0
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* - oracle / weblogic_server
Version / affected range: 14.1.1.0.0
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
References
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
- 1.x is not vulnerable to this attack? No, it might still be susceptible to a separately reported CVE-2021-4104 that, similarly to CVE-2021-44228, allows Remote Code Execution if your logging configuration has Log4j Update: Patch Priority, Affected Versions and CVE-2021-44832
CVE (2)
Malware (2)
Threat Actors (2)
MITRE ATT&CK (8)
Vendors (2)
Products (5)
Tools (1)
Countries (4)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.