CVE-2021-44228: Log4Shell Apache Log4j2 Zero-Day Flaw | Qualys
Summary: An exploit for a critical zero-day in Apache Log4j2, named Log4Shell, was disclosed on December 9, 2021, affecting all versions from 2.0-beta9 through 2.15.0 and allowing remote code execution with system-level privileges, rated CVSS 10.0. Apache fixed it in Log4j2 2.16.0, and Qualys notes the vulnerability is actively exploited in the wild, with reports that a Javascript WebSocket connection can trigger the RCE locally, widening the attack surface.
Bottom line: Log4j2 is a ubiquitous library used by millions of Java applications, so a CVSS 10.0 flaw that grants system-level code execution and is already exploited in the wild puts nearly every Java-dependent system in scope, including transitive dependencies buried inside third-party applications.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-44228CVE-2021-44832CVE-2021-45105
- Related
- Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021-44228) (Updated) Cyber Risks ·CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 10, 2021