Skip to main content

Log4J CVE-2021-45105

MEDIUM
Improper Input Validation (CWE-20)
2021-12-18 security@apache.org
Denial Of Service Apache Debian Oracle Business Intelligence Debian Linux Flexcube Universal Banking Peoplesoft Enterprise Peopletools Utilities Framework Sonicwall E Business Suite Primavera P6 Enterprise Project Portfolio Management Weblogic Server Hyperion Data Relationship Management Email Security Communications Billing And Revenue Management Communications Services Gatekeeper Communications Webrtc Session Controller Enterprise Manager Ops Center Financial Services Analytical Applications Infrastructure Healthcare Foundation Insurance Insbridge Rating And Underwriting Jdeveloper Retail Back Office Retail Returns Management Siebel Ui Framework Mysql Enterprise Monitor Communications Cloud Native Core Console Communications Cloud Native Core Security Edge Protection Proxy Communications Cloud Native Core Unified Data Repository Communications Cloud Native Core Network Function Cloud Native Environment Communications Cloud Native Core Network Repository Function Communications Cloud Native Core Network Slice Selection Function Communications Cloud Native Core Service Communication Proxy Communications Cloud Native Core Policy Agile Engineering Data Management Agile Plm Communications Interactive Session Recorder Communications Diameter Signaling Router Instantis Enterprisetrack Retail Central Office Retail Eftlink Retail Invoice Matching Retail Order Broker Retail Order Management System Retail Point Of Service Retail Price Management Retail Store Inventory Management Webcenter Sites Web Application Firewall Cloud Manager Identity Management Suite Autovue For Agile Product Lifecycle Management Banking Platform Communications Element Manager Communications Evolved Communications Application Server Communications Network Charging And Control Communications Session Report Manager Communications Session Route Manager Enterprise Manager Base Platform Primavera Unifier Retail Merchandising System Retail Service Backbone Webcenter Portal Banking Treasury Management Communications Convergent Charging Controller Communications Unified Inventory Management Data Integrator Primavera Gateway Communications Pricing Design Center Communications User Data Repository Network Security Manager Communications Messaging Server Health Sciences Information Manager Healthcare Master Person Index Retail Integration Bus Log4J Communications Network Integrity Communications Service Broker Enterprise Manager For Peoplesoft Identity Manager Connector Retail Predictive Application Server Communications Convergence Payment Interface Hospitality Suite8 Hyperion Bi Communications Ip Service Activator Communications Eagle Ftp Table Base Retrieval Hyperion Infrastructure Technology Healthcare Data Repository Banking Payments Hyperion Planning Healthcare Translational Research Retail Customer Insights Managed File Transfer Communications Performance Intelligence Center Retail Financial Integration Insurance Data Gateway Banking Deposits And Lines Of Credit Servicing Banking Enterprise Default Management Banking Loans Servicing Banking Party Management Financial Services Model Management And Governance Health Sciences Empirica Signal Health Sciences Inform Communications Asap Retail Data Extractor For Merchandising Sql Developer Agile Plm Mcad Connector Hospitality Token Proxy Service Banking Trade Finance Taleo Platform 6Bk1602 0Aa12 0Tp0 Firmware 6Bk1602 0Aa22 0Tp0 Firmware 6Bk1602 0Aa32 0Tp0 Firmware 6Bk1602 0Aa42 0Tp0 Firmware 6Bk1602 0Aa52 0Tp0 Firmware Communications Eagle Element Management System Hyperion Profitability And Cost Management Hyperion Tax Provision Management Cloud Engine Netapp
5.9
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-20
OWASP Top 10:2025
A03:2021 - Injection
ASVS 5.0
V5 - Validation, Sanitization and Encoding Input validation, output encoding, parameterized queries
Impact

Service disruption affecting availability. In critical infrastructure, DoS can have cascading effects on dependent systems. With a CVSS score of 5.9 (MEDIUM), this represents a moderate risk.
Exploit ScenarioDerived

An attacker sends specially crafted requests that cause excessive resource consumption (CPU, memory, disk) or trigger a crash in the target application.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 70.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 26, 2026

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.

Earlier versions of this analysis (1)
v1 Mar 26, 2026 - 11:19 CVSS 5.9

RemediationAI

A vendor patch is available — apply it immediately. Implement rate limiting and input validation. Use timeout mechanisms for resource-intensive operations. Deploy DDoS protection where applicable.

Affected Packages

maven org.apache.logging.log4j:log4j-core fix: 2.3.1, 2.12.3, 2.17.0
maven org.ops4j.pax.logging:pax-logging-log4j2 fix: 1.9.2, 1.10.9, 1.11.12, 2.0.13

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in maven

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users. This vulnerability is classified as Improper Input Validation (CWE-20).

Know when Log4J gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Nov 21, 2024 - 06:31 nvd
Patch available
CVE Published
Dec 18, 2021 - 12:15 nvd
MEDIUM 5.9

DescriptionNVD

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Executive ViewAI

Why It Matters

CVE-2021-45105 presents moderate security risk, a input validation vulnerability rated CVSS 5.9. Exploitation could compromise the security of affected deployments. With an EPSS score of 70%, this vulnerability has elevated exploitation probability. A patch is available and should be applied during regular vulnerability management.

Business Impact: High
Compensating Controls

Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.

Threat Intelligence Overview

Threat Score
5.3/10
Composite threat intelligence
EPSS Score
70.4%
Top 1% exploitable
Threat Intel
1
1 source
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS THREAT VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 70.4%
Patch available Yes
Active threat Yes
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

110
Low Medium High Critical
KEV: 0
EPSS: +70
CVSS: +30
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)NVD

cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:*
cpe:2.3:a:sonicwall:network_security_manager:*:*:*:*:on-premises:*:*:*
cpe:2.3:a:sonicwall:network_security_manager:*:*:*:*:saas:*:*:*
cpe:2.3:a:sonicwall:web_application_firewall:*:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:6bk1602-0aa12-0tp0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:6bk1602-0aa22-0tp0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:6bk1602-0aa32-0tp0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:6bk1602-0aa42-0tp0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:6bk1602-0aa52-0tp0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_plm_mcad_connector:3.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_deposits_and_lines_of_credit_servicing:2.12.0:*:*:*:*:*:*:*
+ 188 more

More in Log4J

View all
CVE-2021-44228 CRITICAL POC
10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
CVE-2017-5645 CRITICAL POC
9.8 Apr 17

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
CVE-2021-4104 HIGH
7.5 Dec 14

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
CVE-2021-44832 MEDIUM
6.6 Dec 28

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a r
CVE-2019-17571 CRITICAL
9.8 Dec 20

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be explo
CVE-2022-23305 CRITICAL
9.8 Jan 18

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be

CVE-2022-23307 HIGH
8.8 Jan 18

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), th
CVE-2022-23302 HIGH
8.8 Jan 18

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write acce
CVE-2023-26464 HIGH
7.5 Mar 10

** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7
CVE-2020-9488 LOW
3.7 Apr 27

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. Rated low severity (CVSS 3.7), this

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Threat IntelligenceMISP

ATT&CK Techniques (observed)
T1190 - Exploit Public-Facing Application
Sources: MITRE ATT&CK

References

Advisories & patches
PATCH https://www.oracle.com/security-alerts/cpuapr2022.html PATCH https://www.oracle.com/security-alerts/cpujan2022.html ADVISORY https://logging.apache.org/log4j/2.x/security.html ADVISORY https://vuldb.com/vuln/188709 ADVISORY https://vuldb.com/vuln/190847 ADVISORY https://vuldb.com/vuln/190848 ADVISORY https://vuldb.com/vuln/190849 ADVISORY https://vuldb.com/vuln/190890 ADVISORY https://vuldb.com/vuln/190947 ADVISORY https://vuldb.com/vuln/190948 ADVISORY https://vuldb.com/vuln/190997 ADVISORY https://vuldb.com/vuln/190998 ADVISORY https://vuldb.com/vuln/190999 ADVISORY https://vuldb.com/vuln/191164 ADVISORY https://vuldb.com/vuln/191165 ADVISORY https://vuldb.com/vuln/191166 ADVISORY https://vuldb.com/vuln/191167 ADVISORY https://vuldb.com/vuln/191168 REF http://www.openwall.com/lists/oss-security/2021/12/19/1 REF https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf REF https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf REF https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 REF https://security.netapp.com/advisory/ntap-20211218-0001/ REF https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd REF https://www.debian.org/security/2021/dsa-5024 REF https://www.kb.cert.org/vuls/id/930724 REF https://www.oracle.com/security-alerts/cpujul2022.html REF https://www.zerodayinitiative.com/advisories/ZDI-21-1541/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy