Skip to content
Back to search

CVE-2021-44832

MEDIUM
6.6NVD

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

Share:

EPSS · FIRST.org

97.9%probability of exploitation in the next 30 days

Higher than 99% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.

CVSS v3.1 Score

6.6
/ 10.0
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Information

Published
28 déc. 2021
Updated
17 juin 2026
Status
Modified
Source
security@apache.org

Affected products

apache log4j
Versions : 2.3.2, 2.12.4, 2.17.1, 2.0
oracle communications diameter signaling router
Versions : 8.5.1.0
oracle communications interactive session recorder
Versions : 6.3, 6.4
oracle primavera gateway
Versions : 17.12.11, 18.8.13, 19.12.12, 20.12.7, 21.12.0
oracle primavera p6 enterprise project portfolio management
Versions : 19.12.18.0, 20.12.12.0, 21.12.0.0
oracle primavera unifier
Versions : 18.8, 19.12, 20.12, 21.12
oracle retail assortment planning
Versions : 16.0.3
oracle retail fiscal management
Versions : 14.2

Weaknesses (CWE)

CWE-20CWE-74CWE-20

References (24)

Similar CVEs

Other vulnerabilities of type CWE-20

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring