What is the CVSS score of CVE-2021-44832?

CVE-2021-44832 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 53.6%.

How to fix or mitigate CVE-2021-44832?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Java CVE-2021-44832

MEDIUM

Improper Input Validation (CWE-20)

2021-12-28 security@apache.org

RCE Apache Java Cisco Debian Oracle Debian Linux Fedora Primavera P6 Enterprise Project Portfolio Management Weblogic Server Policy Automation Policy Automation For Mobile Devices Siebel Ui Framework Communications Interactive Session Recorder Communications Diameter Signaling Router Retail Order Broker Retail Xstore Point Of Service Flexcube Private Banking Primavera Unifier Primavera Gateway Communications Offline Mediation Controller Log4J Retail Assortment Planning Communications Brm Elastic Charging Engine Health Sciences Data Management Workbench Retail Fiscal Management Product Lifecycle Analytics Cloudcenter Fedoraproject

6.6

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A03:2021 - Injection ASVS 5.0 V5 - Validation, Sanitization and Encoding Input validation, output encoding, parameterized queries
Impact	Complete system compromise — the attacker gains the ability to install malware, steal data, create backdoors, or pivot to other systems on the network. With a CVSS score of 6.6 (MEDIUM), this represents a moderate risk.
Exploit ScenarioDerived	An attacker sends a specially crafted request to the vulnerable service that triggers code execution with the privileges of the running process.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 53.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 26, 2026

Earlier versions of this analysis (1)

v1 Mar 26, 2026 - 11:19 CVSS 6.6

RemediationAI

A vendor patch is available — apply it immediately. Apply vendor patches immediately. Restrict network access to vulnerable services. Implement network segmentation and monitoring for anomalous activity.

Affected Packages

maven org.apache.logging.log4j:log4j-core fix: 2.3.2, 2.12.4, 2.17.1

maven org.ops4j.pax.logging:pax-logging-log4j2 fix: 1.9.2, 1.10.9, 1.11.13, 2.0.14

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in maven

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Remote code execution allows an attacker to run arbitrary commands or code on the target system over a network without prior authentication. This vulnerability is classified as Improper Input Validation (CWE-20).

Know when Java gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Nov 21, 2024 - 06:31 nvd

Patch available

CVE Published

Dec 28, 2021 - 20:15 nvd

MEDIUM 6.6

DescriptionCVE.org

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

Executive ViewAI

Why It Matters

CVE-2021-44832 presents notable security risk, a input validation vulnerability rated CVSS 6.6. Exploitation could compromise the security of affected deployments. With an EPSS score of 54%, this vulnerability has elevated exploitation probability. A patch is available and should be applied during regular vulnerability management.

Business Impact: High

Compensating Controls

Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.

Threat Intelligence Overview

Threat Score

4.9/10

Composite threat intelligence

EPSS Score

53.6%

Top 2% exploitable

Threat Intel

1 source

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS THREAT

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 53.6%

Patch available Yes

Active threat Yes

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +54

CVSS: +33

PoC: 0

Weaponized: 0

Threat intel: +10

Gov advisory: 0

Attack Technique

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*

cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*

cpe:2.3:a:apache:log4j:2.0:beta7:*:*:*:*:*:*

cpe:2.3:a:apache:log4j:2.0:beta8:*:*:*:*:*:*

cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*

cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*

cpe:2.3:a:oracle:primavera_gateway:21.12.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*

cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:21.12.0.0:*:*:*:*:*:*:*

+ 51 more

More in Java

View all

CVE-2012-4681 CRITICAL Emergency POC

9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m

CVE-2015-7450 CRITICAL Emergency POC

9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti

CVE-2013-2465 CRITICAL Act Now POC

9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent

CVE-2011-3544 CRITICAL Act Now POC

9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug

CVE-2010-1871 HIGH Act Now POC

8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to

CVE-2012-1723 CRITICAL Emergency POC

9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up

CVE-2013-0422 CRITICAL Emergency POC

9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using

CVE-2012-0507 CRITICAL Emergency POC

9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up

CVE-2015-4852 CRITICAL Act Now POC

9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL Act Now POC

9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow

CVE-2017-3066 CRITICAL Act Now POC

9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla

CVE-2012-0391 CRITICAL Act Now POC

9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2024-3400 CRITICAL POC

10.0

CVE-2022-47966 CRITICAL POC

9.8

CVE-2023-22515 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2017-9791 CRITICAL POC

9.8

CVE-2017-15944 CRITICAL POC

9.8

CVE-2019-0604 CRITICAL POC

9.8

Same technique RCE

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

Threat IntelligenceMISP

ATT&CK Techniques (observed)

T1190 - Exploit Public-Facing Application

Sources: MITRE ATT&CK

References

Advisories & patches

PATCH https://issues.apache.org/jira/browse/LOG4J2-3293 PATCH https://www.oracle.com/security-alerts/cpuapr2022.html PATCH https://www.oracle.com/security-alerts/cpujan2022.html PATCH https://www.oracle.com/security-alerts/cpujul2022.html ADVISORY https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143 ADVISORY https://vuldb.com/vuln/189422 ADVISORY https://vuldb.com/vuln/190830 ADVISORY https://vuldb.com/vuln/190831 ADVISORY https://vuldb.com/vuln/190886 ADVISORY https://vuldb.com/vuln/190887 REF http://www.openwall.com/lists/oss-security/2021/12/28/1 REF https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf REF https://lists.debian.org/debian-lts-announce/2021/12/msg00036.html REF https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA/ REF https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC/ REF https://security.netapp.com/advisory/ntap-20220104-0001/ REF https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back