CVE-2021-44228
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3,

Publication date: 2021-12-10

Last updated on: 2025-04-03

Assigner: [email protected]

Description
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Affected Vendors & Products
Vendor Product Version
apache log4j From 2.0.1 (inc) to 2.3.1 (exc)
apache log4j *
siemens sppa-t3000_ses3000 *
siemens captial to 2019.1 (exc)
siemens captial *
siemens desigo_cc_advanced_reports *
siemens desigo_cc_advanced_reports *
siemens desigo_cc_advanced_reports *
siemens desigo_cc_advanced_reports *
siemens desigo_cc_advanced_reports *
siemens desigo_cc_info_center *
siemens desigo_cc_info_center *
siemens e-car_operation_center to 2021-12-13 (inc)
siemens energy_engage *
siemens energyip *
siemens energyip *
siemens energyip *
siemens energyip *
siemens energyip_prepay *
siemens energyip_prepay *
siemens gma-manager to 8.6.2j-398 (inc)
siemens industrial_edge_management *
siemens logo\!_soft_comfort *
siemens mendix *
siemens mindsphere to 2021-12-16 (inc)
siemens navigator to 2021-12-13 (inc)
siemens nx *
siemens opcenter_intelligence From 3.2 (inc) to 3.5 (inc)
siemens operation_scheduler to 1.1.3 (exc)
siemens sentron_powermanager *
siemens sentron_powermanager *
siemens siguard_dsa *
siemens siguard_dsa *
siemens siguard_dsa *
siemens sipass_integrated *
siemens sipass_integrated *
siemens siveillance_command to 4.16.2.1 (exc)
siemens siveillance_identity *
siemens siveillance_identity *
siemens siveillance_vantage *
siemens siveillance_viewpoint *
siemens solid_edge_cam_pro *
siemens solid_edge_harness_design to 2020 (inc)
siemens spectrum_power_4 to 4.70 (inc)
siemens spectrum_power_7 to 2.30 (inc)
siemens spectrum_power_7 *
siemens teamcenter *
siemens vesys to 2019.1 (inc)
siemens vesys *
siemens xpedition_enterprise *
siemens xpedition_package_integrator *
intel audio_development_kit *
intel computer_vision_annotation_tool *
intel data_center_manager to 5.1 (exc)
intel genomics_kernel_library *
intel oneapi_sample_browser *
intel secure_device_onboard *
intel sensor_solution_firmware_development_kit *
intel system_debugger *
intel system_studio *
debian debian_linux *
fedoraproject fedora *
fedoraproject fedora *
sonicwall email_security to 10.0.13 (inc)
netapp active_iq_unified_manager *
netapp cloud_insights *
netapp cloud_manager *
netapp cloud_secure_agent *
netapp oncommand_insight *
netapp ontap_tools *
netapp snapcenter *
cisco advanced_malware_protection_virtual_private_cloud_appliance to 3.5.4 (exc)
cisco automated_subsea_tuning to 2.1.0 (exc)
cisco broadworks to 2021.11_1.162 (exc)
cisco business_process_automation to 3.2.003.009 (inc)
cisco cloud_connect to 12.6\(1\) (exc)
cisco cloudcenter to 4.10.0.16 (exc)
cisco cloudcenter_cost_optimizer to 5.5.2 (exc)
cisco cloudcenter_suite_admin to 5.3.1 (exc)
cisco cloudcenter_workload_manager to 5.5.2 (exc)
cisco common_services_platform_collector to 2.9.1.3 (exc)
cisco connected_mobile_experiences to 11.1 (inc)
cisco contact_center_domain_manager to 12.5\(1\) (exc)
cisco contact_center_management_portal to 12.5\(1\) (exc)
cisco crosswork_data_gateway *
cisco crosswork_network_controller to 2.0.1 (exc)
cisco crosswork_network_controller *
cisco crosswork_optimization_engine to 2.0.1 (exc)
cisco crosswork_optimization_engine *
cisco crosswork_platform_infrastructure to 4.0.1 (exc)
cisco crosswork_platform_infrastructure *
cisco crosswork_zero_touch_provisioning to 6.0.0 (inc)
cisco crosswork_zero_touch_provisioning *
cisco customer_experience_cloud_agent to 1.12.1 (exc)
cisco cyber_vision_sensor_management_extension to 4.0.3 (exc)
cisco data_center_network_manager to 11.3\(1\) (exc)
cisco data_center_network_manager *
cisco dna_center to 2.1.2.8 (exc)
cisco dna_spaces\ to 2.5 (exc)
cisco emergency_responder to 11.5\(4\) (exc)
cisco enterprise_chat_and_email to 12.0\(1\) (exc)
cisco evolved_programmable_network_manager to 4.1.1 (inc)
cisco finesse to 12.6\(1\) (exc)
cisco finesse *
cisco identity_services_engine to 2.4.0 (exc)
cisco identity_services_engine *
cisco integrated_management_controller_supervisor to 2.3.2.1 (exc)
cisco intersight_virtual_appliance to 1.0.9-361 (exc)
cisco iot_operations_dashboard *
cisco network_assurance_engine to 6.0.2 (exc)
cisco network_services_orchestrator to 5.3.5.1 (exc)
cisco nexus_dashboard to 2.1.2 (exc)
cisco nexus_insights to 6.0.2 (exc)
cisco optical_network_controller to 1.1.0 (exc)
cisco packaged_contact_center_enterprise to 11.6 (exc)
cisco packaged_contact_center_enterprise *
cisco paging_server to 14.4.1 (exc)
cisco prime_service_catalog to 12.1 (exc)
cisco sd-wan_vmanage to 20.3.4.1 (exc)
cisco smart_phy to 3.2.1 (exc)
cisco ucs_central to 2.0\(1p\) (exc)
cisco ucs_director to 6.8.2.0 (exc)
cisco unified_communications_manager to 11.5\(1\) (exc)
cisco unified_communications_manager *
cisco unified_communications_manager *
cisco unified_communications_manager_im_and_presence_service to 11.5\(1\) (exc)
cisco unified_communications_manager_im_and_presence_service *
cisco unified_contact_center_enterprise to 11.6\(2\) (exc)
cisco unified_contact_center_enterprise *
cisco unified_contact_center_express to 12.5\(1\) (exc)
cisco unified_customer_voice_portal to 11.6 (exc)
cisco unified_customer_voice_portal *
cisco unified_customer_voice_portal *
cisco unified_customer_voice_portal *
cisco unity_connection to 11.5\(1\) (exc)
cisco video_surveillance_operations_manager to 7.14.4 (exc)
cisco virtual_topology_system to 2.6.7 (exc)
cisco virtualized_infrastructure_manager to 3.2.0 (exc)
cisco virtualized_voice_browser to 12.5\(1\) (exc)
cisco wan_automation_engine to 7.3.0.2 (exc)
cisco webex_meetings_server to 3.0 (exc)
cisco webex_meetings_server *
cisco webex_meetings_server *
cisco workload_optimization_manager to 3.2.1 (exc)
cisco unified_intelligence_center to 12.6\(1\) (exc)
cisco unified_sip_proxy to 10.2.1v2 (exc)
cisco unified_workforce_optimization to 11.5\(1\) (exc)
cisco firepower_1010 *
cisco firepower_1120 *
cisco firepower_1140 *
cisco firepower_1150 *
cisco firepower_2110 *
cisco firepower_2120 *
cisco firepower_2130 *
cisco firepower_2140 *
cisco firepower_4110 *
cisco firepower_4112 *
cisco firepower_4115 *
cisco firepower_4120 *
cisco firepower_4125 *
cisco firepower_4140 *
cisco firepower_4145 *
cisco firepower_4150 *
cisco firepower_9300 *
cisco fxos *
cisco fxos *
cisco fxos *
cisco fxos *
cisco fxos *
cisco fxos *
cisco fxos *
cisco fxos *
cisco automated_subsea_tuning *
cisco cloudcenter_suite *
cisco cloudcenter_suite *
cisco cloudcenter_suite *
cisco cloudcenter_suite *
cisco cloudcenter_suite *
cisco common_services_platform_collector *
cisco common_services_platform_collector *
cisco common_services_platform_collector *
cisco common_services_platform_collector *
cisco common_services_platform_collector *
cisco common_services_platform_collector *
cisco common_services_platform_collector *
cisco connected_analytics_for_network_deployment *
cisco connected_analytics_for_network_deployment *
cisco connected_analytics_for_network_deployment *
cisco connected_analytics_for_network_deployment *
cisco connected_analytics_for_network_deployment *
cisco connected_analytics_for_network_deployment *
cisco connected_analytics_for_network_deployment *
cisco connected_analytics_for_network_deployment *
cisco connected_analytics_for_network_deployment *
cisco connected_analytics_for_network_deployment *
cisco connected_analytics_for_network_deployment *
cisco connected_analytics_for_network_deployment *
cisco crosswork_network_automation *
cisco crosswork_network_automation *
cisco crosswork_network_automation *
cisco crosswork_network_automation *
cisco crosswork_network_automation *
cisco cx_cloud_agent *
cisco cyber_vision *
cisco cyber_vision_sensor_management_extension *
cisco dna_center *
cisco dna_spaces *
cisco dna_spaces_connector *
cisco emergency_responder *
cisco emergency_responder *
cisco emergency_responder *
cisco enterprise_chat_and_email *
cisco enterprise_chat_and_email *
cisco enterprise_chat_and_email *
cisco evolved_programmable_network_manager *
cisco evolved_programmable_network_manager *
cisco evolved_programmable_network_manager *
cisco evolved_programmable_network_manager *
cisco evolved_programmable_network_manager *
cisco evolved_programmable_network_manager *
cisco finesse *
cisco firepower_threat_defense *
cisco firepower_threat_defense *
cisco firepower_threat_defense *
cisco firepower_threat_defense *
cisco firepower_threat_defense *
cisco firepower_threat_defense *
cisco firepower_threat_defense *
cisco identity_services_engine *
cisco identity_services_engine *
cisco identity_services_engine *
cisco identity_services_engine *
cisco identity_services_engine *
cisco identity_services_engine *
cisco integrated_management_controller_supervisor *
cisco integrated_management_controller_supervisor *
cisco intersight_virtual_appliance *
cisco mobility_services_engine *
cisco network_assurance_engine *
cisco network_dashboard_fabric_controller *
cisco network_dashboard_fabric_controller *
cisco network_dashboard_fabric_controller *
cisco network_dashboard_fabric_controller *
cisco network_dashboard_fabric_controller *
cisco network_dashboard_fabric_controller *
cisco network_dashboard_fabric_controller *
cisco network_dashboard_fabric_controller *
cisco network_insights_for_data_center *
cisco optical_network_controller *
cisco paging_server *
cisco paging_server *
cisco paging_server *
cisco paging_server *
cisco paging_server *
cisco paging_server *
cisco paging_server *
cisco paging_server *
cisco prime_service_catalog *
cisco sd-wan_vmanage *
cisco sd-wan_vmanage *
cisco sd-wan_vmanage *
cisco sd-wan_vmanage *
cisco sd-wan_vmanage *
cisco sd-wan_vmanage *
cisco sd-wan_vmanage *
cisco smart_phy *
cisco smart_phy *
cisco smart_phy *
cisco smart_phy *
cisco smart_phy *
cisco smart_phy *
cisco ucs_central_software *
cisco ucs_central_software *
cisco ucs_central_software *
cisco ucs_central_software *
cisco ucs_central_software *
cisco ucs_central_software *
cisco ucs_central_software *
cisco ucs_central_software *
cisco ucs_central_software *
cisco ucs_central_software *
cisco ucs_central_software *
cisco unified_communications_manager *
cisco unified_communications_manager *
cisco unified_communications_manager *
cisco unified_communications_manager *
cisco unified_communications_manager *
cisco unified_communications_manager_im_\&_presence_service *
cisco unified_communications_manager_im_\&_presence_service *
cisco unified_computing_system *
cisco unified_contact_center_enterprise *
cisco unified_contact_center_enterprise *
cisco unified_contact_center_enterprise *
cisco unified_contact_center_enterprise *
cisco unified_contact_center_express *
cisco unified_contact_center_express *
cisco unified_contact_center_express *
cisco unified_contact_center_management_portal *
cisco unified_customer_voice_portal *
cisco unified_customer_voice_portal *
cisco unified_customer_voice_portal *
cisco unified_customer_voice_portal *
cisco unified_intelligence_center *
cisco unified_intelligence_center *
cisco unified_sip_proxy *
cisco unified_sip_proxy *
cisco unified_sip_proxy *
cisco unified_sip_proxy *
cisco unified_workforce_optimization *
cisco unity_connection *
cisco unity_connection *
cisco video_surveillance_manager *
cisco video_surveillance_manager *
cisco video_surveillance_manager *
cisco video_surveillance_manager *
cisco virtual_topology_system *
cisco wan_automation_engine *
cisco wan_automation_engine *
cisco wan_automation_engine *
cisco wan_automation_engine *
cisco wan_automation_engine *
cisco wan_automation_engine *
cisco wan_automation_engine *
cisco wan_automation_engine *
snowsoftware snow_commander to 8.10.0 (exc)
snowsoftware vm_access_proxy to 3.6 (exc)
bentley synchro From 6.1 (inc) to 6.2.4.2 (inc)
percussion rhythmyx to 7.3.2 (inc)
apache log4j2 *
apache log4j2 *
apache log4j2 *
apache log4j2 *
apache log4j2 *
apache log4j2 *
apache log4j2 *
apache log4j2 *
apache log4j2 *
apache log4j2 *
apache log4j2 *
apache log4j2 *
apache log4j2 *
apache log4j2 *
apache log4j2 *
apache log4j2 *
apple xcode to 16.0 (inc)
debian debian_linux *
cisco firepower_threat_defense *
siemens sppa-t3000_ses3000_firmware *
siemens 6bk1602-0aa12-0tp0_firmware to 2.7.0 (inc)
siemens 6bk1602-0aa22-0tp0_firmware to 2.7.0 (inc)
siemens 6bk1602-0aa32-0tp0_firmware to 2.7.0 (inc)
siemens 6bk1602-0aa42-0tp0_firmware to 2.7.0 (inc)
siemens 6bk1602-0aa52-0tp0_firmware to 2.7.0 (inc)
siemens logo!_soft_comfort *
siemens spectrum_power_4 *
siemens siveillance_control_pro *
siemens solid_edge_harness_design *
siemens capital *
siemens desigo_cc_advanced_reports *
siemens comos to 10.4.2 (inc)
siemens energyip_prepay to 3.8.0.12 (inc)
siemens siguard_dsa From 4.2 (inc) to 4.4.1 (inc)
siemens vesys *
siemens vesys *
intel oneapi_sample_browser *
intel computer_vision_annotation_tool *
intel datacenter_manager to 5.1 (inc)
netapp solidfire_&_hci_storage_node *
bentley synchro_4d to 6.4.3.2 (inc)
siemens head-end_system_universal_device_integration_system *
siemens industrial_edge_management_hub *
debian debian_linux *
cisco crosswork_data_gateway From 5.0.0 (inc) to 5.0.2 (inc)
cisco fog_director to 1.22 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 Uncontrolled Resource Consumption
CWE-502 Deserialization of Untrusted Data
CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CWE-20 Improper Input Validation
AI Powered Q&A
Can you explain this vulnerability to me?


How can this vulnerability impact me?


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?


What immediate steps should I take to mitigate this vulnerability?


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
Meta Information
CVE Publication Date:
2021-12-10
CVE Last Modified Date:
2025-04-03
Report Generation Date:
2025-06-24
AI Powered Q&A Generation:
2024-11-28
EPSS Last Evaluated Date:
2025-06-03
NVD Report Link: