Business Intelligence CVE-2021-45105

MEDIUM

Improper Input Validation (CWE-20)

2021-12-18 security@apache.org

Denial Of Service Apache Debian Oracle Business Intelligence Debian Linux Flexcube Universal Banking Peoplesoft Enterprise Peopletools Utilities Framework Sonicwall E Business Suite Primavera P6 Enterprise Project Portfolio Management Weblogic Server Hyperion Data Relationship Management Email Security Communications Billing And Revenue Management Communications Services Gatekeeper Communications Webrtc Session Controller Enterprise Manager Ops Center Financial Services Analytical Applications Infrastructure Healthcare Foundation Insurance Insbridge Rating And Underwriting Jdeveloper Retail Back Office Retail Returns Management Siebel Ui Framework Mysql Enterprise Monitor Communications Cloud Native Core Console Communications Cloud Native Core Security Edge Protection Proxy Communications Cloud Native Core Unified Data Repository Communications Cloud Native Core Network Function Cloud Native Environment Communications Cloud Native Core Network Repository Function Communications Cloud Native Core Network Slice Selection Function Communications Cloud Native Core Service Communication Proxy Communications Cloud Native Core Policy Agile Engineering Data Management Agile Plm Communications Interactive Session Recorder Communications Diameter Signaling Router Instantis Enterprisetrack Retail Central Office Retail Eftlink Retail Invoice Matching Retail Order Broker Retail Order Management System Retail Point Of Service Retail Price Management Retail Store Inventory Management Webcenter Sites Web Application Firewall Cloud Manager Identity Management Suite Autovue For Agile Product Lifecycle Management Banking Platform Communications Element Manager Communications Evolved Communications Application Server Communications Network Charging And Control Communications Session Report Manager Communications Session Route Manager Enterprise Manager Base Platform Primavera Unifier Retail Merchandising System Retail Service Backbone Webcenter Portal Banking Treasury Management Communications Convergent Charging Controller Communications Unified Inventory Management Data Integrator Primavera Gateway Communications Pricing Design Center Communications User Data Repository Network Security Manager Communications Messaging Server Health Sciences Information Manager Healthcare Master Person Index Retail Integration Bus Log4J Communications Network Integrity Communications Service Broker Enterprise Manager For Peoplesoft Identity Manager Connector Retail Predictive Application Server Communications Convergence Payment Interface Hospitality Suite8 Hyperion Bi Communications Ip Service Activator Communications Eagle Ftp Table Base Retrieval Hyperion Infrastructure Technology Healthcare Data Repository Banking Payments Hyperion Planning Healthcare Translational Research Retail Customer Insights Managed File Transfer Communications Performance Intelligence Center Retail Financial Integration Insurance Data Gateway Banking Deposits And Lines Of Credit Servicing Banking Enterprise Default Management Banking Loans Servicing Banking Party Management Financial Services Model Management And Governance Health Sciences Empirica Signal Health Sciences Inform Communications Asap Retail Data Extractor For Merchandising Sql Developer Agile Plm Mcad Connector Hospitality Token Proxy Service Banking Trade Finance Taleo Platform 6Bk1602 0Aa12 0Tp0 Firmware 6Bk1602 0Aa22 0Tp0 Firmware 6Bk1602 0Aa32 0Tp0 Firmware 6Bk1602 0Aa42 0Tp0 Firmware 6Bk1602 0Aa52 0Tp0 Firmware Communications Eagle Element Management System Hyperion Profitability And Cost Management Hyperion Tax Provision Management Cloud Engine Netapp

5.9

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

3

Analysis Generated

Mar 26, 2026 - 11:19 vuln.today

Patch released

Nov 21, 2024 - 06:31 nvd

Patch available

CVE Published

Dec 18, 2021 - 12:15 nvd

MEDIUM 5.9

DescriptionNVD

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

AnalysisAI

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.

Technical ContextAI

A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users. This vulnerability is classified as Improper Input Validation (CWE-20).

RemediationAI

A vendor patch is available — apply it immediately. Implement rate limiting and input validation. Use timeout mechanisms for resource-intensive operations. Deploy DDoS protection where applicable.

More in Business Intelligence

View all

CVE-2021-4104 HIGH Act Now

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo

CVE-2020-17530 CRITICAL Act Now POC

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Rated cri

CVE-2020-9480 CRITICAL Act Now POC

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (s

CVE-2022-23305 CRITICAL Act Now

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be

CVE-2020-14864 HIGH This Week POC

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ins

CVE-2019-10219 MEDIUM This Month POC

A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo

CVE-2016-7103 MEDIUM This Month POC

Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web

CVE-2020-11023 MEDIUM This Month POC

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untru

CVE-2021-2456 CRITICAL Act Now

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ana

CVE-2020-2950 CRITICAL Act Now

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ana

CVE-2018-8013 CRITICAL Act Now

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the in

CVE-2022-23307 HIGH This Week

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), th

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

CVE-2024-3400 CRITICAL POC

CVE-2022-47966 CRITICAL POC

CVE-2023-22515 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2017-9791 CRITICAL POC

CVE-2017-15944 CRITICAL POC

CVE-2019-0604 CRITICAL POC

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2011-0611 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2012-0507 CRITICAL POC

CVE-2014-1761 HIGH POC

CVE-2015-5122 CRITICAL POC

CVE-2011-0609 HIGH POC

Share

CVE-2021-45105 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy