CVSS 3.1
6.6 mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HCVE-2021-44832
Medium (6.6). EPSS 98% chance of exploitation in the next 30 days. Fixed in org.apache.logging.log4j:log4j-core 2.12.4, 2.17.1, 2.3.2.
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
Severity
- EPSS
- 98% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-20, CWE-74
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:log4j
- cisco:cloudcenter
- debian:debian_linux
- fedoraproject:fedora
- oracle:communications_brm_-_elastic_charging_engine
- oracle:communications_diameter_signaling_router
- oracle:communications_interactive_session_recorder
- oracle:communications_offline_mediation_controller
- oracle:flexcube_private_banking
- oracle:health_sciences_data_management_workbench
- oracle:policy_automation
- oracle:policy_automation_for_mobile_devices
- oracle:primavera_gateway
- oracle:primavera_p6_enterprise_project_portfolio_management
- oracle:primavera_unifier
- oracle:product_lifecycle_analytics
- oracle:retail_assortment_planning
- oracle:retail_fiscal_management
- oracle:retail_order_broker
- oracle:retail_xstore_point_of_service
- oracle:siebel_ui_framework
- oracle:weblogic_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8489-44mv-ggj8 | Maven | org.apache.logging.log4j:log4j-core | >=2.0-beta7 <2.3.2 | 2.3.2 |
| GHSA-8489-44mv-ggj8 | Maven | org.apache.logging.log4j:log4j-core | >=2.4 <2.12.4 | 2.12.4 |
| GHSA-8489-44mv-ggj8 | Maven | org.apache.logging.log4j:log4j-core | >=2.13.0 <2.17.1 | 2.17.1 |
| GHSA-8489-44mv-ggj8 | Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >=1.8.0 <1.9.2 | 1.9.2 |
| GHSA-8489-44mv-ggj8 | Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >=1.10.0 <1.10.9 | 1.10.9 |
| GHSA-8489-44mv-ggj8 | Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >=1.11.0 <1.11.13 | 1.11.13 |
| GHSA-8489-44mv-ggj8 | Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >=2.0.0 <2.0.14 | 2.0.14 |