NexaPulse
Subscribe
5.9mediumMedium

CVE-2021-45105

Apache Log4j

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Exploitation status

  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is reachable over a network, without needing local access.
  • For an attacker who can reach it, exploitation depends on conditions outside the attacker's control.
  • To exploit it, no account is needed.
  • Beyond that, no action by a user is required.

Scoring

CVSS
5.9 (v3.1)
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Assigned by
security@apache.org

Dates

Published
2021-12-18
Last modified
2026-08-25
Sources
NVD

Affected products

  • Apache Log4j2.0 - 2.3.1, 2.4 - 2.12.3, 2.13.0 - 2.16.0
  • Netapp Cloud Managerall versions
  • Debian Debian Linux10.0, 11.0
  • Sonicwall Email Security- 10.0.12
  • Sonicwall Network Security Manager2.0 - 3.0
  • Sonicwall Web Application Firewall3.0.0 - 3.1.0
  • Sonicwall 6bk1602-0aa12-0tp0 Firmware- 2.7.0
  • Sonicwall 6bk1602-0aa12-0tp0all versions
  • Sonicwall 6bk1602-0aa22-0tp0 Firmware- 2.7.0
  • Sonicwall 6bk1602-0aa22-0tp0all versions
  • Sonicwall 6bk1602-0aa32-0tp0 Firmware- 2.7.0
  • Sonicwall 6bk1602-0aa32-0tp0all versions

As listed in the NVD configuration data. Not a statement about your estate.

References