Skip to content
Back to search

CVE-2021-44228

CRITICAL
10.0 RansomwareNVD

Summary

generated automatically from NVD data

Apache Log4j2 (log4j-core) 2.0-beta9 through 2.15.0, excluding 2.12.2, 2.12.3 and 2.3.1, has a JNDI flaw: it does not guard against attacker-controlled LDAP and other JNDI endpoints. An attacker who controls log messages or their parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. The behavior is disabled by default from 2.15.0 and removed from 2.16.0. It carries a CVSS v3.1 score of 10.0 (CRITICAL), is listed in CISA KEV with known ransomware use, and also affects some Siemens products.

NVD description

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Share:

⚠️ Actively exploited — CISA KEV

This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2021-12-10. It is confirmed exploited in the wild and must be patched as a priority.

Remediation deadline (US federal agencies): 2021-12-24

Used in known ransomware campaigns.

EPSS · FIRST.org

100.0%probability of exploitation in the next 30 days

Higher than 99% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.

In-depth analysis on cveo.tech

We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.

CVSS v3.1 Score

10.0
/ 10.0
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Information

Published
10 déc. 2021
Updated
11 août 2026
Status
Analyzed
Source
security@apache.org

Affected products

siemens 6bk1602-0aa12-0tp0 firmware
Versions : 2.7.0
siemens 6bk1602-0aa22-0tp0 firmware
Versions : 2.7.0
siemens 6bk1602-0aa32-0tp0 firmware
Versions : 2.7.0
siemens 6bk1602-0aa42-0tp0 firmware
Versions : 2.7.0
siemens 6bk1602-0aa52-0tp0 firmware
Versions : 2.7.0
apache log4j
Versions : 2.3.1, 2.12.2, 2.15.0, 2.0
siemens sppa-t3000 ses3000 firmware
siemens capital
Versions : 2019.1

Weaknesses (CWE)

CWE-20CWE-400CWE-502CWE-917

References (103)

Similar CVEs

Other vulnerabilities of type CWE-20

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring