CVE-2021-44228
Apache Software Foundation Apache Log4j2
Summary
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoin…
Published: 2021-12-10
Analysis
🟠 High — imminent exploitation
Weakness: Insecure Deserialization (CWE-502). Untrusted serialized data leads to code execution.
How it's exploited: Exploitable over the network (internet-reachable), unauthenticated, no user interaction, and with low complexity. The flaw can pivot to other components (scope changed).
⚠️ Critical combo: remote, unauthenticated and no interaction → trivial to automate.
Impact: Full compromise (confidentiality, integrity and availability).
Status: Exploit probability (EPSS, 30 days): 100% — high.
- Apply the vendor patch according to risk priority.
- Reduce exposure: keep it off the internet; firewall, VPN or network segmentation.
- Detect: turn this CVE into detection rules.
MITRE ATT&CK technique: T1190 · Exploit Public-Facing Application · T1059 · Command and Scripting Interpreter
Practice it in the arsenal: WAF Bypass · PowerShell Decoder · Reverse Shells
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The vector encodes how it's exploited (translated above, in the analysis). Break it down in the CVSS tool →
Sources: CISA KEV · EPSS · FIRST.org · NVD. Analysis derived from the CVSS vector and exploitation status (no AI). Informational; always verify against the vendor's official advisory.