{"id":"CVE-2021-44228","published":"2021-12-10T10:15:09Z","modified":"2026-08-11T19:33:44Z","title":"Apache Log4j2 Remote Code Execution Vulnerability","vendor":"Apache","product":"Log4j2","tier":"core","eol":null,"description":{"text":"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is in the JNDI lookup features of Apache Log4j2 (log4j-core) in versions 2.0-beta9 through 2.15.0, where configuration, log messages, and parameters are not protected against attacker-controlled LDAP and other JNDI endpoints. An attacker who can control log messages or log message parameters can get arbitrary code loaded from LDAP servers and executed when message lookup substitution is enabled.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:06Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":1.0,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2021-12-10","dueDate":"2021-12-24","ransomware":true,"requiredAction":"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-12-06","exploitedFirstSeen":"2021-12-06","ransomware":true,"evidence":[{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa21-336a","date":"2021-12-06"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-12-10"},{"url":"https://blog.netlab.360.com/threat-alert-log4j-vulnerability-has-been-adopted-by-two-linux-botnets/","date":"2021-12-11"},{"url":"https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11"},{"url":"https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/#NightSky","date":"2021-12-11"},{"url":"https://www.bleepingcomputer.com/news/security/hackers-start-pushing-malware-in-worldwide-log4shell-attacks/","date":"2021-12-12"},{"url":"https://businessinsights.bitdefender.com/technical-advisory-zero-day-critical-vulnerability-in-log4j2-exploited-in-the-wild","date":"2021-12-13"},{"url":"https://www.cadosecurity.com/analysis-of-initial-in-the-wild-attacks-exploiting-log4shell-log4j-cve-2021-44228/","date":"2021-12-13"},{"url":"https://www.darkreading.com/attacks-breaches/attackers-target-log4j-to-drop-ransomware-web-shells-backdoors","date":"2021-12-14"},{"url":"https://www.bleepingcomputer.com/news/security/log4j-vulnerability-now-used-by-state-backed-hackers-access-brokers/","date":"2021-12-15"}],"evidenceTotal":1296,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"AWS Log4Shell Hotpatch Flaw Lets Local Users Run Commands as Root on Amazon Linux","url":"https://otx.alienvault.com/pulse/6adb8a3c8f5d4b2d1f4c4cfa","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"skynox7: Proxyjacking Edge Devices Into Residential Proxies","url":"https://otx.alienvault.com/pulse/6ad9e65d5b3dc4f0fcdc04c3","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"},{"id":"CWE-400","name":"Uncontrolled Resource Consumption"},{"id":"CWE-502","name":"Deserialization of Untrusted Data"},{"id":"CWE-917","name":"Improper Neutralization of Special Elements used in an Expression Language Statement"}],"references":[{"url":"http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2022/Dec/2","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2022/Jul/11","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2022/Mar/23","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/10/1","tags":["Mailing List","Mitigation","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/10/2","tags":["Mailing List","Mitigation","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/10/3","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/13/1","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/13/2","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/14/4","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/15/3","tags":["Mailing List","Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf","tags":["Third Party Advisory"]},{"url":"https://github.com/cisagov/log4j-affected-db","tags":["Third Party Advisory"]},{"url":"https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md","tags":["Broken Link","Product","US Government Resource"]},{"url":"https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/","tags":["Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/","tags":["Release Notes"]},{"url":"https://logging.apache.org/log4j/2.x/security.html","tags":["Release Notes","Vendor Advisory"]},{"url":"https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/","tags":["Patch","Third Party Advisory","Vendor Advisory"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20211210-0007/","tags":["Third Party Advisory"]},{"url":"https://support.apple.com/kb/HT213189","tags":["Third Party Advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","tags":["Third Party Advisory"]},{"url":"https://twitter.com/kurtseifried/status/1469345530182455296","tags":["Broken Link","Exploit","Third Party Advisory"]},{"url":"https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2021/dsa-5020","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html","tags":["Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/930724","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/alert-cve-2021-44228.html","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["Patch","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2022/Dec/2","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2022/Jul/11","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2022/Mar/23","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/10/1","tags":["Mailing List","Mitigation","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/10/2","tags":["Mailing List","Mitigation","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/10/3","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/13/1","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/13/2","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/14/4","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/15/3","tags":["Mailing List","Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf","tags":["Third Party Advisory"]},{"url":"https://github.com/cisagov/log4j-affected-db","tags":["Third Party Advisory"]},{"url":"https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md","tags":["Broken Link","Product","US Government Resource"]},{"url":"https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/","tags":["Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/","tags":["Release Notes"]},{"url":"https://logging.apache.org/log4j/2.x/security.html","tags":["Release Notes","Vendor Advisory"]},{"url":"https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/","tags":["Patch","Third Party Advisory","Vendor Advisory"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20211210-0007/","tags":["Third Party Advisory"]},{"url":"https://support.apple.com/kb/HT213189","tags":["Third Party Advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","tags":["Third Party Advisory"]},{"url":"https://twitter.com/kurtseifried/status/1469345530182455296","tags":["Broken Link","Exploit","Third Party Advisory"]},{"url":"https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2021/dsa-5020","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html","tags":["Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/930724","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/alert-cve-2021-44228.html","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228","tags":["Third Party Advisory","US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"This remote code execution vulnerability is exploited through maliciously-crafted requests to a web application. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1486","name":"Data Encrypted for Impact","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2021-44228, known as Log4Shell, affects Apache’s Log4j library, an open-source logging framework. An actor can exploit this vulnerability by submitting a specially crafted request to a vulnerable system that causes that system to execute arbitrary code. The request allows a cyber actor to take full control over the system. The actor can then steal information, launch ransomware, or conduct other malicious activity.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1496","name":"Resource Hijacking","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2021-44228, known as Log4Shell, affects Apache’s Log4j library, an open-source logging framework. An actor can exploit this vulnerability by submitting a specially crafted request to a vulnerable system that causes that system to execute arbitrary code. The request allows a cyber actor to take full control over the system. The actor can then steal information, launch ransomware, or conduct other malicious activity.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2021-44228, known as Log4Shell, affects Apache’s Log4j library, an open-source logging framework. An actor can exploit this vulnerability by submitting a specially crafted request to a vulnerable system that causes that system to execute arbitrary code. The request allows a cyber actor to take full control over the system. The actor can then steal information, launch ransomware, or conduct other malicious activity.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1608.001","name":"Upload Malware","tactics":["resource-development"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2021-44228, known as Log4Shell, affects Apache’s Log4j library, an open-source logging framework. An actor can exploit this vulnerability by submitting a specially crafted request to a vulnerable system that causes that system to execute arbitrary code. The request allows a cyber actor to take full control over the system. The actor can then steal information, launch ransomware, or conduct other malicious activity.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"}],"reports":[{"id":"SRC-f144807c3c05fbc98a1a","title":"Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/","date":"2022-05-09","mentions":[{"quote":"In February of 2022, DEV-0401 was observed deploying the Pandora ransomware family, primarily via unpatched VMware Horizon systems vulnerable to the Log4j 2 CVE-2021-44228 vulnerability.","start":43573,"end":43759},{"quote":"Apache log4j CVE-2021-44228","start":62648,"end":62675}]},{"id":"SRC-0231bb8de4ee25e012ca","title":"APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit","publisher":"research.checkpoint.com","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/","date":"2022-01-11","mentions":[{"quote":"To exploit the Log4j vulnerability (CVE-2021-44228), the attackers chose one of the publicly available open-source JNDI Exploit Kits, since removed from GitHub due to its enormous popularity following the vulnerability emergence.","start":1955,"end":2184}]},{"id":"SRC-f2a36ba1c313ceadb907","title":"Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-320a","date":null,"mentions":[{"quote":"CISA observed bi-directional traffic between the network and a known malicious IP address associated with exploitation of the Log4Shell vulnerability (CVE-2021-44228) in VMware Horizon servers.","start":2793,"end":2986}]},{"id":"SRC-e030a140d352155c7a50","title":"RaaS AvosLocker Incident Response Analysis","publisher":"linkedin.com","url":"https://www.linkedin.com/pulse/raas-avoslocker-incident-response-analysis-fl%C3%A1vio-costa?trk=articles_directory","date":null,"mentions":[{"quote":"topology above: vulnerabilities associated to Log4J were found on the VMWare Horizon Unified Access Gateways, UAG01 and UAG02, those were CVE-2021-44228 / CVE-2021-45046 / CVE-2021-45105 / CVE-2021-44832, which can potentially allow remote code execution on Unified Access Gateway by the low privilege","start":2357,"end":2658}]},{"id":"SRC-db754fc6f8e3b44fee8e","title":"People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a","date":null,"mentions":[{"quote":"APT40 rapidly exploits newly public vulnerabilities in widely used software such as Log4J (CVE-2021-44228), Atlassian Confluence (CVE-2021-31207, CVE-2021-26084) and Microsoft Exchange (CVE-2021-31207, CVE-2021-34523, CVE-2021-34473).","start":3713,"end":3947}]},{"id":"SRC-b804e28bf5894dd4955f","title":"Whitepaper Name Goes","publisher":"trustwave.com","url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/Trustwave_SpiderLabs_2023_Hospitality_Sector_Threat_Landscape.pdf","date":null,"mentions":[{"quote":"▪ Apache Log4J (CVE-2021-44228)","start":42876,"end":42907},{"quote":"HTSearch (CVE-2000-0208)\r\n▪ Jive Openfire (CVE-2008-6508)\r\n▪ HTTP Directory Traversal\r\n▪ HTTP SQL Injection\r\nExploit Procedures Used by Attackers\r\nInitial Foothold\r\nExpansion\r\n/ Pivoting\r\nMalware\r\nExfiltration /\r\nPost Compromise\r\nInitial Payload Threat Actor\r\nCVE-2021-44228\r\n52% Apache Log4J (CVE-2021-44228)","start":42947,"end":43256}]},{"id":"SRC-1cc1eb9fcf150573ab2b","title":"Nation-state threat actor Mint Sandstorm refines tradecraft to attack high-value targets","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2023/04/18/nation-state-threat-actor-mint-sandstorm-refines-tradecraft-to-attack-high-value-targets/","date":null,"mentions":[{"quote":"Apache Log4j2 (aka Log4Shell) (CVE-2021-44228 and CVE-2021-45046): Microsoft’s guidance for organizations using applications vulnerable to Log4Shell exploitation can be found here.","start":15001,"end":15181}]},{"id":"SRC-18fd26fa020f9a3dac70","title":"The Tortoise and The Malwahare","publisher":"pwc.com","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html","date":null,"mentions":[{"quote":"We assess that Teal Kurma has likely continued leveraging major CVEs in its current campaigns, particularly ones with publicly available proof-of-concept code such as CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847.","start":6231,"end":6448}]},{"id":"SRC-06a2fa5397da4000010a","title":"ICS/OT CYBERSECURITY","publisher":"hub.dragos.com","url":"https://hub.dragos.com/hubfs/333%20Year%20in%20Review/2021/2021%20ICS%20OT%20Cybersecurity%20Year%20In%20Review%20-%20Dragos%202021.pdf?hsLang=en","date":null,"mentions":[{"quote":"The Log4j vulnerability (CVE-2021-\r\n44228) allows for remote code execution and access to servers and hardware that","start":92013,"end":92128}]},{"id":"SRC-00137fe8f183bbad0ec9","title":"Chinese Threat Actor Used Modified Cobalt Strike Variant to Attack Taiwanese Critical Infrastructure","publisher":"blog.eclecticiq.com","url":"https://blog.eclecticiq.com/chinese-threat-actor-used-modified-cobalt-strike-variant-to-attack-taiwanese-critical-infrastructure","date":null,"mentions":[{"quote":"threat actor primarily focuses on four different known remote code execution (RCE) vulnerabilities during their operations:•    CVE-2023-21839      Oracle WebLogic Server RCE [13]•    CVE-2021-3129      Laravel debug mode RCE [14]•    CVE-2020-2551      Oracle WebLogic RCE [15]•    CVE-2021-44228     Apache Log4j","start":4810,"end":5124},{"quote":"[16]      “NVD - CVE-2021-44228.”","start":23324,"end":23357},{"quote":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228 (accessed Apr.","start":23358,"end":23420}]}],"affected":[{"ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","vulnerableRanges":[">=2.13.0, <2.15.0",">=2.0-beta9, <2.3.1",">=2.4, <2.12.2"],"patched":["2.15.0","2.3.1","2.12.2"],"from":["GHSA-jfh8-c2jp-5v3q"],"provenance":"source"},{"ecosystem":"Maven","package":"com.guicedee.services:log4j-core","vulnerableRanges":["<=1.2.1.2-jre17"],"patched":[],"from":["GHSA-jfh8-c2jp-5v3q"],"provenance":"source"},{"ecosystem":"Maven","package":"org.xbib.elasticsearch:log4j","vulnerableRanges":[],"patched":[],"from":["GHSA-jfh8-c2jp-5v3q"],"provenance":"source"},{"ecosystem":"Maven","package":"uk.co.nichesolutions.logging.log4j:log4j-core","vulnerableRanges":[],"patched":[],"from":["GHSA-jfh8-c2jp-5v3q"],"provenance":"source"},{"ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","vulnerableRanges":[">=1.8.0, <1.9.2",">=1.10.0, <1.10.8",">=1.11.0, <1.11.10",">=2.0.0, <2.0.11"],"patched":["1.9.2","1.10.8","1.11.10","2.0.11"],"from":["GHSA-jfh8-c2jp-5v3q"],"provenance":"source"}],"advisories":[{"id":"GHSA-jfh8-c2jp-5v3q","url":"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","vulnerableRanges":[">=2.13.0, <2.15.0"],"patched":["2.15.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-jfh8-c2jp-5v3q","url":"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","vulnerableRanges":[">=2.0-beta9, <2.3.1"],"patched":["2.3.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-jfh8-c2jp-5v3q","url":"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","vulnerableRanges":[">=2.4, <2.12.2"],"patched":["2.12.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-jfh8-c2jp-5v3q","url":"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q","severity":"CRITICAL","ecosystem":"Maven","package":"com.guicedee.services:log4j-core","vulnerableRanges":["<=1.2.1.2-jre17"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-jfh8-c2jp-5v3q","url":"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q","severity":"CRITICAL","ecosystem":"Maven","package":"org.xbib.elasticsearch:log4j","vulnerableRanges":[],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-jfh8-c2jp-5v3q","url":"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q","severity":"CRITICAL","ecosystem":"Maven","package":"uk.co.nichesolutions.logging.log4j:log4j-core","vulnerableRanges":[],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-jfh8-c2jp-5v3q","url":"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q","severity":"CRITICAL","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","vulnerableRanges":[">=1.8.0, <1.9.2"],"patched":["1.9.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-jfh8-c2jp-5v3q","url":"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q","severity":"CRITICAL","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","vulnerableRanges":[">=1.10.0, <1.10.8"],"patched":["1.10.8"],"provenance":"source","from":"GHSA"},{"id":"GHSA-jfh8-c2jp-5v3q","url":"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q","severity":"CRITICAL","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","vulnerableRanges":[">=1.11.0, <1.11.10"],"patched":["1.11.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-jfh8-c2jp-5v3q","url":"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q","severity":"CRITICAL","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","vulnerableRanges":[">=2.0.0, <2.0.11"],"patched":["2.0.11"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-34768","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-34768","exploited":true,"exploitedSince":"2021-12-10","provenance":"source"},"exploits":[{"id":50590,"url":"https://www.exploit-db.com/exploits/50590","title":"Apache Log4j2 2.14.1 - Information Disclosure","type":"remote","platform":"java","date":"2021-12-14","verified":false,"provenance":"source"},{"id":50592,"url":"https://www.exploit-db.com/exploits/50592","title":"Apache Log4j 2 - Remote Code Execution (RCE)","type":"remote","platform":"java","date":"2021-12-14","verified":false,"provenance":"source"},{"id":51183,"url":"https://www.exploit-db.com/exploits/51183","title":"AD Manager Plus 7122 - Remote Code Execution (RCE)","type":"remote","platform":"java","date":"2023-04-01","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2021-12-14"},"pocGithub":{"count":445,"skipped":37,"earliest":"2021-12-09","earliestUrl":"https://github.com/tangxiaofeng7/CVE-2021-44228-Apache-Log4j-Rce","repos":[{"name":"fullhunt/log4j-scan","url":"https://github.com/fullhunt/log4j-scan","stars":3424,"created":"2021-12-13"},{"name":"kozmer/log4j-shell-poc","url":"https://github.com/kozmer/log4j-shell-poc","stars":1843,"created":"2021-12-10"},{"name":"christophetd/log4shell-vulnerable-app","url":"https://github.com/christophetd/log4shell-vulnerable-app","stars":1144,"created":"2021-12-10"},{"name":"Puliczek/CVE-2021-44228-PoC-log4j-bypass-words","url":"https://github.com/Puliczek/CVE-2021-44228-PoC-log4j-bypass-words","stars":952,"created":"2021-12-10"},{"name":"logpresso/CVE-2021-44228-Scanner","url":"https://github.com/logpresso/CVE-2021-44228-Scanner","stars":864,"created":"2021-12-11"}]},"metasploit":[{"name":"Log4Shell HTTP Scanner","module":"auxiliary/scanner/http/log4shell_scanner","type":"auxiliary","disclosureDate":"2021-12-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/log4shell_scanner.rb"},{"name":"Log4Shell HTTP Header Injection","module":"exploit/multi/http/log4shell_header_injection","type":"exploit","disclosureDate":"2021-12-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/log4shell_header_injection.rb"},{"name":"UniFi Network Application Unauthenticated JNDI Injection RCE (via Log4Shell)","module":"exploit/multi/http/ubiquiti_unifi_log4shell","type":"exploit","disclosureDate":"2021-12-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/ubiquiti_unifi_log4shell.rb"},{"name":"VMware vCenter Server Unauthenticated JNDI Injection RCE (via Log4Shell)","module":"exploit/multi/http/vmware_vcenter_log4shell","type":"exploit","disclosureDate":"2021-12-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/vmware_vcenter_log4shell.rb"},{"name":"MobileIron Core Unauthenticated JNDI Injection RCE (via Log4Shell)","module":"exploit/linux/http/mobileiron_core_log4shell","type":"exploit","disclosureDate":"2021-12-12","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/mobileiron_core_log4shell.rb"}],"nuclei":[{"id":"CVE-2021-44228","name":"Apache Log4j2 Remote Code Injection","severity":"critical","path":"http/cves/2021/CVE-2021-44228.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44228.yaml"}],"first":{"date":"2021-12-09","source":"PoC-in-GitHub","url":"https://github.com/tangxiaofeng7/CVE-2021-44228-Apache-Log4j-Rce"},"provenance":"source"},"detections":{"cveRules":[{"title":"Log4j RCE CVE-2021-44228 in Fields","id":"9be472ed-893c-4ec0-94da-312d2765f654","level":"high","status":"test","path":"rules-emerging-threats/2021/Exploits/CVE-2021-44228/web_cve_2021_44228_log4j_fields.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-44228/web_cve_2021_44228_log4j_fields.yml","techniques":["T1190"]},{"title":"Potential CVE-2021-44228 Exploitation Attempt - VMware Horizon","id":"3eb91f0a-0060-424a-a676-59f5fdd75610","level":"high","status":"test","path":"rules-emerging-threats/2021/Exploits/CVE-2021-44228/proc_creation_win_exploit_cve_2021_44228_vmware_horizon_log4j.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-44228/proc_creation_win_exploit_cve_2021_44228_vmware_horizon_log4j.yml","techniques":["T1190"]}]},"exploitRefs":["http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html","http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html","http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html","http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html","http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html","http://seclists.org/fulldisclosure/2022/Dec/2","https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228","https://twitter.com/kurtseifried/status/1469345530182455296","https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html","http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html","http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html","http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html","http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html","http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html","http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html","http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html","https://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html","https://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html","https://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html","https://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html","https://github.com/tangxiaofeng7/apache-log4j-poc"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"secondary","techniques":["T1608.001","T1505.003","T1486","T1496"],"provenance":"source"}],"timeline":[{"date":"2021-12-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cisa.gov/news-events/cybersecurity-advisories/aa21-336a","provenance":"source"},{"date":"2021-12-09","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2021-12-09, Exploit-DB 2021-12-14","url":"https://github.com/tangxiaofeng7/CVE-2021-44228-Apache-Log4j-Rce","provenance":"source"},{"date":"2021-12-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","provenance":"source"},{"date":"2021-12-10","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-12-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-34768","provenance":"source"},{"date":"2022-01-11","kind":"report","label":"Named in research.checkpoint.com: APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/","provenance":"machine"},{"date":"2022-05-09","kind":"report","label":"Named in microsoft.com: Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":90.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1790 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 1.0000"},{"name":"Named in threat reports","points":10.0,"detail":"10 reports"},{"name":"Public exploit code","points":5.0,"detail":"11 NVD references tagged Exploit; 3 Exploit-DB entries; 9 NVD exploit links; 5 advisory exploit references; 445 PoC-in-GitHub repos; 5 Metasploit modules; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-log4j2-cve-2021-44228","children":[{"from":"CVE-2021-44228","to":"CVE-2021-4104","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-fp5r-v3w9-4333","via":"reference","url":"https://www.cve.org/CVERecord?id=CVE-2021-44228"}]},{"from":"CVE-2021-44228","to":"CVE-2021-4125","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed.","from":"CVE.org","in":"CVE-2021-4125"}]},{"from":"CVE-2021-44228","to":"CVE-2021-45046","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations.","from":"NVD","in":"CVE-2021-45046"},{"kind":"osv-related","provenance":"source","id":"GHSA-7rjr-3q55-vv33","via":"reference","url":"https://www.cve.org/CVERecord?id=CVE-2021-44228"},{"kind":"osv-related","provenance":"source","id":"GHSA-jfh8-c2jp-5v3q","via":"reference","url":"https://github.com/advisories/GHSA-7rjr-3q55-vv33"},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.logging.log4j:log4j-core","fromFixed":"2.15.0","toFixed":"2.16.0","daysApart":4},{"kind":"version-step","provenance":"source","package":"Maven:org.ops4j.pax.logging:pax-logging-log4j2","fromFixed":"1.11.10","toFixed":"1.11.11","daysApart":4},{"kind":"similar","provenance":"machine","score":0.31,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2023-26464","published":"2023-03-10","fixed":"2.0","kev":false},{"cve":"CVE-2017-5645","published":"2017-04-17","fixed":"2.8.2","kev":false},{"cve":"CVE-2020-9488","published":"2020-04-27","fixed":"2.13.2","kev":false,"link":{"from":"CVE-2020-9488","to":"CVE-2021-44228","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.logging.log4j:log4j-core","fromFixed":"2.13.2","toFixed":"2.15.0","daysApart":592}]}},{"cve":"CVE-2021-44228","published":"2021-12-10","fixed":"2.15.0","kev":true},{"cve":"CVE-2021-45046","published":"2021-12-14","fixed":"2.16.0","kev":true},{"cve":"CVE-2021-45105","published":"2021-12-18","fixed":"2.17.0","kev":false},{"cve":"CVE-2021-44832","published":"2021-12-28","fixed":"2.17.1","kev":false}],"package":"Maven:org.apache.logging.log4j:log4j-core"}}