CVE-2021-4104
HighSummary
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. This can lead to remote code execution through unauthorized JNDI requests.
Risk Assessment
The organization is at serious risk of malicious code execution, which could result in data loss or system takeover.
Recommendation
It is recommended to upgrade to Log4j 2 to mitigate this and other known vulnerabilities, as Log4j 1.2 has reached end of life in August 2015.
Other vulnerabilities in Log4j 1.2
See all- CVE-2022-23302High
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. This can lead to remote code execution.
- CVE-2022-23305Critical
The JDBCAppender in Log4j 1.2.x accepts SQL statements as a configuration parameter, allowing attackers to manipulate SQL by entering crafted strings into input fields or headers of an application. This can lead to unintended SQL queries being executed.
Original NVD description (English source)
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.