{"id":"CVE-2021-4104","published":"2021-12-14T00:00:00Z","modified":"2026-05-28T19:53:14Z","title":"Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2","vendor":"Apache Software Foundation","product":"Apache Log4j 1.x","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Log4j 1.x","versions":["Apache Log4j 1.2 1.2.x"]}],"description":{"text":"JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a deserialization of untrusted data issue in the JMSAppender component of Apache Log4j 1.x (1.2 line). It affects only deployments that have been specifically configured to use JMSAppender, which is not the default. An attacker who already has write access to the Log4j configuration can supply TopicBindingName and TopicConnectionFactoryBindingName values that cause JMSAppender to make JNDI requests, enabling remote code execution. The attack requires network access, low privileges (write access to the configuration), and a high-complexity condition, with no user interaction needed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:46Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.80599,"percentile":0.99624,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2022-04-26","exploitedFirstSeen":"2022-04-26","ransomware":false,"evidence":[{"url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-annex-download.pdf","date":"2022-04-26"},{"url":"https://www.secureworks.com/research/gold-melody-profile-of-an-initial-access-broker","date":"2023-09-20"},{"url":"https://www.secureworks.com/research/threat-profiles/gold-melody","date":"2023-09-21"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":18,"pulses":[{"name":"EbeeMar2026 Pt7","url":"https://otx.alienvault.com/pulse/69cd4a1d9132694a02d2fd1f","created":"2026-04-01"},{"name":"Gold Melody Clone By Bluenumberone credit","url":"https://otx.alienvault.com/pulse/69c742886d1361c58c0a5388","created":"2026-03-28"},{"name":"Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files","url":"https://otx.alienvault.com/pulse/664cc3c1938ed0b9abf026a2","created":"2024-05-21"},{"name":"ACTUALIZACION | Oracle Critical Patch Update Advisory - January 2024","url":"https://otx.alienvault.com/pulse/65c0fd55c5d3c780a06aa227","created":"2024-02-05"},{"name":"GOLD MELODY: Profile of an Initial Access Broke","url":"https://otx.alienvault.com/pulse/650ded880cdcdb63f3e6d6a4","created":"2023-09-22"},{"name":"GOLD MELODY: Profile of an Initial Access Broker | Secureworks","url":"https://otx.alienvault.com/pulse/650c275b63ae6e8908bb044c","created":"2023-09-21"},{"name":"Cyber Group 'Gold Melody' Selling Compromised Access to Ransomware Attackers","url":"https://otx.alienvault.com/pulse/650c22ef421b73bfc5084a2f","created":"2023-09-21"},{"name":"GOLD MELODY: Profile of an Initial Access Broker | Secureworks","url":"https://otx.alienvault.com/pulse/650c117ced2ba5bf9e98cc55","created":"2023-09-21"},{"name":"ACTUALIZACION | Oracle Critical Patch Update Advisory - July 2023","url":"https://otx.alienvault.com/pulse/64bace8d5d470a6a7baaa8a9","created":"2023-07-21"},{"name":"CYB 303 - Apache Log4j Vulnerability Guidance | CISA","url":"https://otx.alienvault.com/pulse/6461c30239f7f30e66299d2c","created":"2023-05-15"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44228","tags":[]},{"url":"https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126","tags":[]},{"url":"https://access.redhat.com/security/cve/CVE-2021-4104","tags":[]},{"url":"https://www.kb.cert.org/vuls/id/930724","tags":["third-party-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/01/18/3","tags":["mailing-list"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":[]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20211223-0007/","tags":[]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":[]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":[]},{"url":"https://security.gentoo.org/glsa/202209-02","tags":["vendor-advisory"]},{"url":"https://security.gentoo.org/glsa/202310-16","tags":["vendor-advisory"]},{"url":"https://security.gentoo.org/glsa/202312-02","tags":["vendor-advisory"]},{"url":"https://security.gentoo.org/glsa/202312-04","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"log4j:log4j","vulnerableRanges":[">=1.2.0, <=1.2.17"],"patched":[],"from":["GHSA-fp5r-v3w9-4333"],"provenance":"source"},{"ecosystem":"Maven","package":"org.zenframework.z8.dependencies.commons:log4j-1.2.17","vulnerableRanges":["<=2.0"],"patched":[],"from":["GHSA-fp5r-v3w9-4333"],"provenance":"source"}],"advisories":[{"id":"GHSA-fp5r-v3w9-4333","url":"https://github.com/advisories/GHSA-fp5r-v3w9-4333","severity":"HIGH","ecosystem":"Maven","package":"log4j:log4j","vulnerableRanges":[">=1.2.0, <=1.2.17"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-fp5r-v3w9-4333","url":"https://github.com/advisories/GHSA-fp5r-v3w9-4333","severity":"HIGH","ecosystem":"Maven","package":"org.zenframework.z8.dependencies.commons:log4j-1.2.17","vulnerableRanges":["<=2.0"],"patched":[],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-2514","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-2514","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":1,"earliest":"2021-12-14","earliestUrl":"https://github.com/cckuailong/log4shell_1.x","repos":[{"name":"cckuailong/log4shell_1.x","url":"https://github.com/cckuailong/log4shell_1.x","stars":20,"created":"2021-12-14"},{"name":"open-AIMS/log4j","url":"https://github.com/open-AIMS/log4j","stars":0,"created":"2022-01-10"}]},"first":{"date":"2021-12-14","source":"PoC-in-GitHub","url":"https://github.com/cckuailong/log4shell_1.x"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-12-14","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-4104","provenance":"source"},{"date":"2021-12-14","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/cckuailong/log4shell_1.x","provenance":"source"},{"date":"2022-04-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-annex-download.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":68.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1647 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9962"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":2.9,"detail":"18 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-log4j2-cve-2021-44228","parents":[{"from":"CVE-2021-44228","to":"CVE-2021-4104","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-fp5r-v3w9-4333","via":"reference","url":"https://www.cve.org/CVERecord?id=CVE-2021-44228"}]}]}}