CVE-2021-44832
Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration
- Published
- Updated
- Reserved
- Assigned by
- apache
Description
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
Timeline
ID reserved
By apache
- 17 days later
· 17 days later
Published
- 4 years later
· 4 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | Medium6.6 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Medium6.6 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 97.9% · top 0.1% of all CVEs (8 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.6.
Weakness
Affected products
Apache Software Foundation · Apache Log4j2
- affected log4j-core – < 2.17.1
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.apache.logging.log4j:log4j-coreGHSA-8489-44mv-ggj8 (opens in a new tab)
- Mavenorg.ops4j.pax.logging:pax-logging-log4j2GHSA-8489-44mv-ggj8 (opens in a new tab)
References (12)
- 20211210 Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021 (opens in a new tab)vendor-advisoryx_refsource_CISCOx_transferred
- https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143 (opens in a new tab)x_refsource_MISCx_transferred
- https://issues.apache.org/jira/browse/LOG4J2-3293 (opens in a new tab)x_refsource_MISCx_transferred
- [oss-security] 20211228 CVE-2021-44832: Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [debian-lts-announce] 20211229 [SECURITY] [DLA 2870-1] apache-log4j2 security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf (opens in a new tab)x_refsource_CONFIRMx_transferred
- FEDORA-2021-c6f471ce0f (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- FEDORA-2021-1bd9151bab (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- https://www.oracle.com/security-alerts/cpujan2022.html (opens in a new tab)x_refsource_MISCx_transferred
- https://security.netapp.com/advisory/ntap-20220104-0001/ (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://www.oracle.com/security-alerts/cpuapr2022.html (opens in a new tab)x_refsource_MISCx_transferred
- https://www.oracle.com/security-alerts/cpujul2022.html (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-8489-44mv-ggj8 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2021-44832)Record last updated .