CVE-2021-44228

Critical · CVSS 10EPSS 100.0%CISA KEVCWE-20 · Improper Input Validation

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

References

NVD MITRE CVE.org CISA KEV

Published Dec 10, 2021

Community ground truth

Community verdict

4 verdicts

Not a real issue

Includes TruePositive's curated baseline from public sources — community verdicts accrue on top.

to add your verdict.

Community real-world severity: Critical (Critical 3 · High 1) — CVSS base score 10

In line with its CVSS base score.

Field notes & remediation

Verdicts are the quick signal — notes are the evidence and fixes behind them.

0
Field note · Mara OkonkwoCurated
Trivially exploitable wherever attacker-controlled data reaches a log.*() call — headers, User-Agent, usernames, chat messages. The JNDI lookup fires from the log message body, which is why it spread so far. Reachability is the only real gate.
0
Remediation · Diego RamírezCurated
Upgrade to Log4j 2.17.1+. The early formatMsgNoLookups=true / log4j2.noFormatMsgLookup workaround is incomplete — it does not cover all sinks (see CVE-2021-45046). Patch, don't flag-flip.
0
Field note · Waleed AzizCurated
Marked conditional only because plenty of internal apps run a JDK/com.sun.jndi.ldap.object.trustURLCodebase=false config or network egress controls that block the second-stage fetch. Still treat as critical until you've proven the path is dead.