Log4J CVE-2021-45105

MEDIUM

Improper Input Validation (CWE-20)

2021-12-18 security@apache.org

Denial Of Service Apache Log4J Cloud Manager Debian Linux Email Security Network Security Manager Web Application Firewall 6Bk1602 0Aa12 0Tp0 Firmware 6Bk1602 0Aa22 0Tp0 Firmware 6Bk1602 0Aa32 0Tp0 Firmware 6Bk1602 0Aa42 0Tp0 Firmware 6Bk1602 0Aa52 0Tp0 Firmware Agile Engineering Data Management Agile Plm Agile Plm Mcad Connector Autovue For Agile Product Lifecycle Management Banking Deposits And Lines Of Credit Servicing Banking Enterprise Default Management Banking Loans Servicing Banking Party Management Banking Payments Banking Platform Banking Trade Finance Banking Treasury Management Business Intelligence Communications Asap Communications Billing And Revenue Management Communications Cloud Native Core Console Communications Cloud Native Core Network Function Cloud Native Environment Communications Cloud Native Core Network Repository Function Communications Cloud Native Core Network Slice Selection Function Communications Cloud Native Core Policy Communications Cloud Native Core Security Edge Protection Proxy Communications Cloud Native Core Service Communication Proxy Communications Cloud Native Core Unified Data Repository Communications Convergence Communications Convergent Charging Controller Communications Diameter Signaling Router Communications Eagle Element Management System Communications Eagle Ftp Table Base Retrieval Communications Element Manager Communications Evolved Communications Application Server Communications Interactive Session Recorder Communications Ip Service Activator Communications Messaging Server Communications Network Charging And Control Communications Network Integrity Communications Performance Intelligence Center Communications Pricing Design Center Communications Service Broker Communications Services Gatekeeper Communications Session Report Manager Communications Session Route Manager Communications Unified Inventory Management Communications User Data Repository Communications Webrtc Session Controller Data Integrator E Business Suite Enterprise Manager Base Platform Enterprise Manager For Peoplesoft Enterprise Manager Ops Center Financial Services Analytical Applications Infrastructure Financial Services Model Management And Governance Flexcube Universal Banking Health Sciences Empirica Signal Health Sciences Inform Health Sciences Information Manager Healthcare Data Repository Healthcare Foundation Healthcare Master Person Index Healthcare Translational Research Hospitality Suite8 Hospitality Token Proxy Service Hyperion Bi Hyperion Data Relationship Management Hyperion Infrastructure Technology Hyperion Planning Hyperion Profitability And Cost Management Hyperion Tax Provision Identity Management Suite Identity Manager Connector Instantis Enterprisetrack Insurance Data Gateway Insurance Insbridge Rating And Underwriting Jdeveloper Managed File Transfer Management Cloud Engine Mysql Enterprise Monitor Payment Interface Peoplesoft Enterprise Peopletools Primavera Gateway Primavera P6 Enterprise Project Portfolio Management Primavera Unifier Retail Back Office Retail Central Office Retail Customer Insights Retail Data Extractor For Merchandising Retail Eftlink Retail Financial Integration Retail Integration Bus Retail Invoice Matching Retail Merchandising System Retail Order Broker Retail Order Management System Retail Point Of Service Retail Predictive Application Server Retail Price Management Retail Returns Management Retail Service Backbone Retail Store Inventory Management Siebel Ui Framework Sql Developer Taleo Platform Utilities Framework Webcenter Portal Webcenter Sites Weblogic Server

5.9

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

3

Analysis Generated

Mar 26, 2026 - 11:19 vuln.today

Patch released

Nov 21, 2024 - 06:31 nvd

Patch available

CVE Published

Dec 18, 2021 - 12:15 nvd

MEDIUM 5.9

DescriptionNVD

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

AnalysisAI

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.

Technical ContextAI

A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users. This vulnerability is classified as Improper Input Validation (CWE-20).

RemediationAI

A vendor patch is available — apply it immediately. Implement rate limiting and input validation. Use timeout mechanisms for resource-intensive operations. Deploy DDoS protection where applicable.

More in Log4J

View all

CVE-2021-44228 CRITICAL Act Now POC

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c

CVE-2017-5645 CRITICAL Act Now POC

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events

CVE-2021-4104 HIGH Act Now

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo

CVE-2019-17571 CRITICAL Act Now

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be explo

CVE-2022-23305 CRITICAL Act Now

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be

CVE-2022-23307 HIGH This Week

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), th

CVE-2022-23302 HIGH This Week

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write acce

CVE-2023-26464 HIGH This Week

** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7

CVE-2020-9488 LOW Monitor

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. Rated low severity (CVSS 3.7), this

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

CVE-2024-3400 CRITICAL POC

CVE-2022-47966 CRITICAL POC

CVE-2023-22515 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2017-9791 CRITICAL POC

CVE-2017-15944 CRITICAL POC

CVE-2019-0604 CRITICAL POC

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2011-0611 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2012-0507 CRITICAL POC

CVE-2014-1761 HIGH POC

CVE-2015-5122 CRITICAL POC

CVE-2011-0609 HIGH POC

Share

CVE-2021-45105 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy