CVE
CVE-2021-44832
- First Reported
- Jun 21, 2022
- Latest Reported
- Jun 21, 2022
CVE Enrichment
- CVSS
- 6.6 MEDIUM
- EPSS
- 97.91%
- EPSS Percentile
- 99.91%
- CISA KEV
- Not listed
Description
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- security@apache.org
- Published
- 29-Dec-2021 03:15
- Last Modified
- 17-Jun-2026 11:12
- EPSS Date
- 2026-10-12
- CWE
- CWE-20, CWE-74
CVSS Vector
CVSS:3.1 AV:N /
AC:H /
PR:H /
UI:N /
S:U /
C:H /
I:H /
A:H
Affected Products / Versions
- apache / log4j
Version / affected range: * · from (inclusive) 2.0.1 · before (exclusive) 2.3.2
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* - apache / log4j
Version / affected range: * · from (inclusive) 2.4 · before (exclusive) 2.12.4
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* - apache / log4j
Version / affected range: * · from (inclusive) 2.13.0 · before (exclusive) 2.17.1
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* - apache / log4j
Version / affected range: 2.0
cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:* - apache / log4j
Version / affected range: 2.0
cpe:2.3:a:apache:log4j:2.0:beta7:*:*:*:*:*:* - apache / log4j
Version / affected range: 2.0
cpe:2.3:a:apache:log4j:2.0:beta8:*:*:*:*:*:* - apache / log4j
Version / affected range: 2.0
cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:* - apache / log4j
Version / affected range: 2.0
cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:* - apache / log4j
Version / affected range: 2.0
cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:* - oracle / communications_diameter_signaling_router
Version / affected range: * · from (inclusive) 8.0.0.0 · through (inclusive) 8.5.1.0
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* - oracle / communications_interactive_session_recorder
Version / affected range: 6.3
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3:*:*:*:*:*:*:* - oracle / communications_interactive_session_recorder
Version / affected range: 6.4
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:* - oracle / primavera_gateway
Version / affected range: * · from (inclusive) 17.12.0 · through (inclusive) 17.12.11
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* - oracle / primavera_gateway
Version / affected range: * · from (inclusive) 18.8.0 · through (inclusive) 18.8.13
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* - oracle / primavera_gateway
Version / affected range: * · from (inclusive) 19.12.0 · through (inclusive) 19.12.12
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* - oracle / primavera_gateway
Version / affected range: * · from (inclusive) 20.12.0 · through (inclusive) 20.12.7
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* - oracle / primavera_gateway
Version / affected range: 21.12.0
cpe:2.3:a:oracle:primavera_gateway:21.12.0:*:*:*:*:*:*:* - oracle / primavera_p6_enterprise_project_portfolio_management
Version / affected range: * · from (inclusive) 19.12.0 · through (inclusive) 19.12.18.0
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:* - oracle / primavera_p6_enterprise_project_portfolio_management
Version / affected range: * · from (inclusive) 20.12.0.0 · through (inclusive) 20.12.12.0
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:* - oracle / primavera_p6_enterprise_project_portfolio_management
Version / affected range: 21.12.0.0
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:21.12.0.0:*:*:*:*:*:*:* - oracle / primavera_unifier
Version / affected range: 18.8
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* - oracle / primavera_unifier
Version / affected range: 19.12
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* - oracle / primavera_unifier
Version / affected range: 20.12
cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* - oracle / primavera_unifier
Version / affected range: 21.12
cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:* - oracle / retail_assortment_planning
Version / affected range: 16.0.3
cpe:2.3:a:oracle:retail_assortment_planning:16.0.3:*:*:*:*:*:*:* - oracle / retail_fiscal_management
Version / affected range: 14.2
cpe:2.3:a:oracle:retail_fiscal_management:14.2:*:*:*:*:*:*:* - oracle / siebel_ui_framework
Version / affected range: 21.12
cpe:2.3:a:oracle:siebel_ui_framework:21.12:*:*:*:*:*:*:* - oracle / weblogic_server
Version / affected range: 12.2.1.3.0
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* - oracle / weblogic_server
Version / affected range: 12.2.1.4.0
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* - oracle / weblogic_server
Version / affected range: 14.1.1.0.0
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* - cisco / cloudcenter
Version / affected range: 4.10.0.16
cpe:2.3:a:cisco:cloudcenter:4.10.0.16:*:*:*:*:*:*:* - fedoraproject / fedora
Version / affected range: 34
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* - fedoraproject / fedora
Version / affected range: 35
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* - debian / debian_linux
Version / affected range: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* - oracle / communications_brm_-_elastic_charging_engine
Version / affected range: * · before (exclusive) 12.0.0.4.6
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:*:*:*:*:*:*:*:* - oracle / communications_brm_-_elastic_charging_engine
Version / affected range: 12.0.0.5.0
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.5.0:*:*:*:*:*:*:* - oracle / communications_diameter_signaling_router
Version / affected range: * · from (inclusive) 8.3.0.0 · through (inclusive) 8.5.1.0
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* - oracle / communications_offline_mediation_controller
Version / affected range: * · before (exclusive) 12.0.0.4.4
cpe:2.3:a:oracle:communications_offline_mediation_controller:*:*:*:*:*:*:*:* - oracle / communications_offline_mediation_controller
Version / affected range: 12.0.0.5.0
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.5.0:*:*:*:*:*:*:* - oracle / flexcube_private_banking
Version / affected range: 12.1.0
cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* - oracle / health_sciences_data_management_workbench
Version / affected range: 2.5.2.1
cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1:*:*:*:*:*:*:* - oracle / health_sciences_data_management_workbench
Version / affected range: 3.0.0.0
cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0:*:*:*:*:*:*:* - oracle / health_sciences_data_management_workbench
Version / affected range: 3.1.0.3
cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.1.0.3:*:*:*:*:*:*:* - oracle / policy_automation
Version / affected range: * · from (inclusive) 12.2.0 · through (inclusive) 12.2.24
cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:* - oracle / policy_automation_for_mobile_devices
Version / affected range: * · from (inclusive) 12.2.0 · through (inclusive) 12.2.24
cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:* - oracle / primavera_p6_enterprise_project_portfolio_management
Version / affected range: * · from (inclusive) 19.12.0.0 · through (inclusive) 19.12.18.0
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:* - oracle / product_lifecycle_analytics
Version / affected range: 3.6.1
cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:* - oracle / retail_order_broker
Version / affected range: 18.0
cpe:2.3:a:oracle:retail_order_broker:18.0:*:*:*:*:*:*:* - oracle / retail_order_broker
Version / affected range: 19.1
cpe:2.3:a:oracle:retail_order_broker:19.1:*:*:*:*:*:*:* - oracle / retail_xstore_point_of_service
Version / affected range: 17.0.4
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* - oracle / retail_xstore_point_of_service
Version / affected range: 18.0.3
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* - oracle / retail_xstore_point_of_service
Version / affected range: 19.0.2
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* - oracle / retail_xstore_point_of_service
Version / affected range: 20.0.1
cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:* - oracle / retail_xstore_point_of_service
Version / affected range: 21.0.1
cpe:2.3:a:oracle:retail_xstore_point_of_service:21.0.1:*:*:*:*:*:*:* - oracle / siebel_ui_framework
Version / affected range: * · through (inclusive) 21.12
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*
References
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
CVE (3)
Malware (4)
People (3)
Threat Actors (2)
MITRE ATT&CK (4)
Vendors (1)
Products (16)
Tools (4)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.