Threat Source Newsletter (Jan. 6, 2022)

Summary: Cisco Talos reported that the critical Log4j vulnerability, tracked as CVE-2021-44228 and nicknamed Log4Shell, remained under active exploitation weeks after disclosure, with Microsoft warning that state-sponsored actors and cyber criminals were still targeting the widely used library. The flaw carries a maximum CVSS score of 10.0, can be exploited by an unauthenticated remote attacker in default configurations to take over an affected server, and Talos said remediation will likely take years given how widely the component is used, including as a dependency in enterprise web applications such as Elastic.
Why it matters: A maximum-severity flaw that an unauthenticated attacker can use to seize a server, still being worked by state-sponsored actors weeks after disclosure, is now a multi-year remediation problem because Log4j sits inside applications and services you may not have inventoried.

Read the original at Cisco Talos ↗

Topics: Supply Chain & AppSec
Mentions: CVE-2021-44228
Related: CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 10, 2021
From Log4j to IIS, China’s Hackers Turn Legacy Bugs into Global Espionage Tools Cyber Risks ·
Threat Source Newsletter (Dec. 16, 2021) Cyber Risks ·