Cyber Posture

CVE-2021-44228

CriticalCISA KEVActive ExploitationPublic PoCRansomware-linked

Published: 10 December 2021

Published
10 December 2021
Modified
20 February 2026
KEV Added
10 December 2021
Patch
11 December 2021
CVSS Score 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.9436 100.0th percentile
Risk Priority 97 60% EPSS · 20% KEV · 20% CVSS

Description

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Security Summary

Automated synthesis unavailable for this CVE.

Details

CWE(s)
CWE-20CWE-400CWE-502CWE-917
KEV Date Added
10 December 2021

Affected Products

siemens
6bk1602-0aa12-0tp0 firmware
≤ 2.7.0
siemens
6bk1602-0aa22-0tp0 firmware
≤ 2.7.0
siemens
6bk1602-0aa32-0tp0 firmware
≤ 2.7.0
siemens
6bk1602-0aa42-0tp0 firmware
≤ 2.7.0
siemens
6bk1602-0aa52-0tp0 firmware
≤ 2.7.0
apache
log4j
2.0 · 2.0.1 — 2.3.1 · 2.4.0 — 2.12.2 · 2.13.0 — 2.15.0
siemens
sppa-t3000 ses3000 firmware
all versions
siemens
capital
2019.1 · ≤ 2019.1
siemens
comos
≤ 10.4.2
siemens
desigo cc advanced reports
3.0, 4.0, 4.1, 4.2, 5.0
+133 more product configuration(s) — see NVD for full list

Threat-Actor Attribution

Contiaka Conti ransomware
Microsoft Threat Intelligence reported Conti ransomware operators exploiting Log4Shell for initial access in December 2021.
Lazarus Group (G0032)aka APT38
ESET attributed exploitation of CVE-2021-44228 to the North Korean Lazarus Group in campaigns against South Korean targets.
APT41 (G0096)aka Winnti
Microsoft reported APT41 and other Chinese state-sponsored actors exploiting Log4Shell in multiple campaigns.

References