Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-4104

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Published

2021-12-14T12:15:12.200

Last Modified

2024-11-21T06:36:54.560

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

6.8

Impact Score

6.4

Weaknesses
  • Type: Secondary
    CWE-502
  • Type: Primary
    CWE-502
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache log4j 1.2 Yes
Operating System fedoraproject fedora 35 Yes
Application redhat codeready_studio 12.0 Yes
Application redhat integration_camel_k - Yes
Application redhat integration_camel_quarkus - Yes
Application redhat jboss_a-mq 6.0.0 Yes
Application redhat jboss_a-mq 7 Yes
Application redhat jboss_a-mq_streaming - Yes
Application redhat jboss_data_grid 7.0.0 Yes
Application redhat jboss_data_virtualization 6.0.0 Yes
Application redhat jboss_enterprise_application_platform 6.0.0 Yes
Application redhat jboss_enterprise_application_platform 7.0 Yes
Application redhat jboss_fuse 6.0.0 Yes
Application redhat jboss_fuse 7.0.0 Yes
Application redhat jboss_fuse_service_works 6.0 Yes
Application redhat jboss_operations_network 3.0 Yes
Application redhat jboss_web_server 3.0 Yes
Application redhat openshift_application_runtimes - Yes
Application redhat openshift_container_platform 4.6 Yes
Application redhat openshift_container_platform 4.7 Yes
Application redhat openshift_container_platform 4.8 Yes
Application redhat process_automation 7.0 Yes
Application redhat single_sign-on 7.0 Yes
Application redhat software_collections - Yes
Operating System redhat enterprise_linux 6.0 Yes
Operating System redhat enterprise_linux 7.0 Yes
Operating System redhat enterprise_linux 8.0 Yes
Application oracle advanced_supply_chain_planning 12.1 Yes
Application oracle advanced_supply_chain_planning 12.2 Yes
Application oracle business_intelligence 5.9.0.0.0 Yes
Application oracle business_intelligence 12.2.1.3.0 Yes
Application oracle business_intelligence 12.2.1.4.0 Yes
Application oracle business_process_management_suite 12.2.1.3.0 Yes
Application oracle business_process_management_suite 12.2.1.4.0 Yes
Application oracle communications_eagle_ftp_table_base_retrieval 4.5 Yes
Application oracle communications_messaging_server 8.1 Yes
Application oracle communications_network_integrity 7.3.6 Yes
Application oracle communications_offline_mediation_controller < 12.0.0.4.0 Yes
Application oracle communications_offline_mediation_controller 12.0.0.5.0 Yes
Application oracle communications_unified_inventory_management 7.3.4 Yes
Application oracle communications_unified_inventory_management 7.3.5 Yes
Application oracle communications_unified_inventory_management 7.4.1 Yes
Application oracle communications_unified_inventory_management 7.4.2 Yes
Application oracle e-business_suite_cloud_manager_and_cloud_backup_module 2.2.1.1.1 Yes
Application oracle enterprise_manager_base_platform 13.4.0.0 Yes
Application oracle enterprise_manager_base_platform 13.5.0.0 Yes
Application oracle financial_services_revenue_management_and_billing_analytics 2.7.0.0 Yes
Application oracle financial_services_revenue_management_and_billing_analytics 2.7.0.1 Yes
Application oracle financial_services_revenue_management_and_billing_analytics 2.8.0.0 Yes
Application oracle fusion_middleware_common_libraries_and_tools 12.2.1.4.0 Yes
Application oracle goldengate - Yes
Application oracle healthcare_data_repository 8.1.0 Yes
Application oracle hyperion_data_relationship_management < 11.2.8.0 Yes
Application oracle hyperion_infrastructure_technology < 11.2.8.0 Yes
Application oracle identity_management_suite 12.2.1.3.0 Yes
Application oracle identity_management_suite 12.2.1.4.0 Yes
Application oracle jdeveloper 12.2.1.3.0 Yes
Application oracle mysql_enterprise_monitor ≤ 8.0.29 Yes
Application oracle retail_allocation 14.1.3.2 Yes
Application oracle retail_allocation 15.0.3.1 Yes
Application oracle retail_allocation 16.0.3 Yes
Application oracle retail_allocation 19.0.1 Yes
Application oracle retail_extract_transform_and_load 13.2.5 Yes
Application oracle stream_analytics - Yes
Application oracle timesten_grid - Yes
Application oracle tuxedo 12.2.2.0.0 Yes
Application oracle utilities_testing_accelerator 6.0.0.1.1 Yes
Application oracle utilities_testing_accelerator 6.0.0.2.2 Yes
Application oracle utilities_testing_accelerator 6.0.0.3.1 Yes
Application oracle weblogic_server 12.2.1.3.0 Yes
Application oracle weblogic_server 12.2.1.4.0 Yes
Application oracle weblogic_server 14.1.1.0.0 Yes
References