CVE-2021-45046 — Vulnerability intelligence

Apache — Log4j2

Published: 2021-12-14T16:55:09.000Z

CVSS

9

CISA KEV

Known exploitation

Original source text (not a translation)

Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.

Sources

• Apache Log4j2 Deserialization of Untrusted Data Vulnerability
• Original advisory
• Original advisory
• CVE-2021-45046