CVE-2022-23302
HighSummary
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. This can lead to remote code execution.
Risk Assessment
Organizations may be exposed to remote code execution, which can lead to serious security breaches and data loss.
Recommendation
It is recommended to upgrade to Log4j 2 to mitigate this vulnerability and other issues from previous versions.
Other vulnerabilities in Log4j 1.x
See all- CVE-2021-4104High
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. This can lead to remote code execution through unauthorized JNDI requests.
- CVE-2022-23305Critical
The JDBCAppender in Log4j 1.2.x accepts SQL statements as a configuration parameter, allowing attackers to manipulate SQL by entering crafted strings into input fields or headers of an application. This can lead to unintended SQL queries being executed.
Original NVD description (English source)
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.