CVE-2021-45046

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2021-12-14

Last updated on: 2025-10-27

Assigner: Apache Software Foundation

Description

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2021-12-14

Last Modified

2025-10-27

Generated

2026-11-05

AI Q&A

2024-10-31

EPSS Evaluated

2025-08-20

NVD

CVE-2021-45046

Affected Vendors & Products

Vendor	Product	Version / Range
apache	log4j	From 2.0.1 (inc) to 2.12.2 (exc)
apache	log4j	From 2.13.0 (inc) to 2.16.0 (exc)
apache	log4j	2.0
apache	log4j	2.0
apache	log4j	2.0
apache	log4j	2.0
cvat	computer_vision_annotation_tool	*
intel	audio_development_kit	*
intel	datacenter_manager	*
intel	genomics_kernel_library	*
intel	oneapi	*
intel	secure_device_onboard	*
intel	sensor_solution_firmware_development_kit	*
intel	system_debugger	*
intel	system_studio	*
siemens	sppa-t3000_ses3000_firmware	*
siemens	sppa-t3000_ses3000	*
siemens	captial	to 2019.1 (exc)
siemens	captial	2019.1
siemens	captial	2019.1
siemens	comos	*
siemens	desigo_cc_advanced_reports	4.0
siemens	desigo_cc_advanced_reports	4.1
siemens	desigo_cc_advanced_reports	4.2
siemens	desigo_cc_advanced_reports	5.0
siemens	desigo_cc_advanced_reports	5.1
siemens	desigo_cc_info_center	5.0
siemens	desigo_cc_info_center	5.1
siemens	e-car_operation_center	to 2021-12-13 (exc)
siemens	energy_engage	3.1
siemens	energyip	8.5
siemens	energyip	8.6
siemens	energyip	8.7
siemens	energyip	9.0
siemens	energyip_prepay	3.7
siemens	energyip_prepay	3.8
siemens	gma-manager	to 8.6.2j-398 (exc)
siemens	head-end_system_universal_device_integration_system	*
siemens	industrial_edge_management	*
siemens	industrial_edge_management_hub	to 2021-12-13 (exc)
siemens	logo\!_soft_comfort	*
siemens	mendix	*
siemens	mindsphere	to 2021-12-11 (exc)
siemens	navigator	to 2021-12-13 (exc)
siemens	nx	*
siemens	opcenter_intelligence	to 3.2 (inc)
siemens	operation_scheduler	to 1.1.3 (inc)
siemens	sentron_powermanager	4.1
siemens	sentron_powermanager	4.2
siemens	siguard_dsa	4.2
siemens	siguard_dsa	4.3
siemens	siguard_dsa	4.4
siemens	sipass_integrated	2.80
siemens	sipass_integrated	2.85
siemens	siveillance_command	to 4.16.2.1 (inc)
siemens	siveillance_control_pro	*
siemens	siveillance_identity	1.5
siemens	siveillance_identity	1.6
siemens	siveillance_vantage	*
siemens	siveillance_viewpoint	*
siemens	solid_edge_cam_pro	*
siemens	solid_edge_harness_design	to 2020 (exc)
siemens	solid_edge_harness_design	2020
siemens	solid_edge_harness_design	2020
siemens	solid_edge_harness_design	2020
siemens	spectrum_power_4	to 4.70 (exc)
siemens	spectrum_power_4	4.70
siemens	spectrum_power_4	4.70
siemens	spectrum_power_4	4.70
siemens	spectrum_power_7	to 2.30 (exc)
siemens	spectrum_power_7	2.30
siemens	spectrum_power_7	2.30
siemens	spectrum_power_7	2.30
siemens	teamcenter	*
siemens	tracealertserverplus	*
siemens	vesys	to 2019.1 (exc)
siemens	vesys	2019.1
siemens	vesys	2019.1
siemens	vesys	2019.1
siemens	xpedition_enterprise	*
siemens	xpedition_package_integrator	*
debian	debian_linux	10.0
debian	debian_linux	11.0
sonicwall	email_security	to 10.0.12 (exc)
fedoraproject	fedora	34
fedoraproject	fedora	35
siemens	6bk1602-0aa12-0tp0	*
siemens	6bk1602-0aa12-0tp0_firmware	to 2.7.0 (exc)
siemens	6bk1602-0aa22-0tp0	*
siemens	6bk1602-0aa22-0tp0_firmware	to 2.7.0 (exc)
siemens	6bk1602-0aa32-0tp0	*
siemens	6bk1602-0aa32-0tp0_firmware	to 2.7.0 (exc)
siemens	6bk1602-0aa42-0tp0	*
siemens	6bk1602-0aa42-0tp0_firmware	to 2.7.0 (exc)
siemens	6bk1602-0aa52-0tp0	*
siemens	6bk1602-0aa52-0tp0_firmware	to 2.7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-917	The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

Attack-Flow Graph

Executive Summary

This vulnerability, identified as CVE-2021-45046, is related to a software called Apache Log4j. It was discovered that a previous fix for another vulnerability was not complete in certain settings. This means that attackers could potentially send harmful data through a specific logging feature, which could lead to unauthorized access to information or even allow them to run harmful code on the affected systems.

Impact Analysis

If you use software that relies on Apache Log4j, this vulnerability could put your data at risk. Attackers could exploit this weakness to access sensitive information or execute harmful actions on your system, which could lead to data breaches or system failures.

Compliance Impact

This vulnerability could impact compliance with regulations like GDPR and HIPAA because it poses a risk to the security and privacy of sensitive data. If an organization experiences a data breach due to this vulnerability, it may face legal consequences and penalties for not adequately protecting personal information.

Mitigation Strategies

You should update to Log4j version 2.16.0 for Java 8 or 2.12.2 for Java 7, as these versions fix the issue by removing support for message lookup patterns and disabling JNDI functionality by default.

Hi! I’m here to help you understand CVE-2021-45046. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...