Log4j 1.2 vulnerabilities

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. This can lead to remote code execution.

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. This can lead to remote code execution through unauthorized JNDI requests.

The JDBCAppender in Log4j 1.2.x accepts SQL statements as a configuration parameter, allowing attackers to manipulate SQL by entering crafted strings into input fields or headers of an application. This can lead to unintended SQL queries being executed.