{"cve_id":"CVE-2021-44832","published":"2021-12-28T20:15:08.400000+00:00","last_modified":"2026-06-17T04:12:52.013000+00:00","vuln_status":"Modified","description":"Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","base_score":6.6,"base_severity":"MEDIUM","attack_vector":"NETWORK","privileges_req":"HIGH","user_interaction":"NONE","scope":"UNCHANGED","impact_c":"HIGH","impact_i":"HIGH","impact_a":"HIGH","cwe_ids":["CWE-20","CWE-74"],"in_kev":false,"kev_date_added":null,"kev_ransomware":false,"epss_score":0.97906,"epss_percentile":0.99908,"cap_rule_version":"0.1.1","stage":"EXECUTION","req_access":"PRIV","req_vector":"NETWORK","req_user_interaction":false,"grant_access":"PRIV","caps":["CODE_EXEC"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-09-18T09:55:13.130039+00:00","first_seen":"2021-12-28T20:15:08.400000+00:00","kev_first_seen":null,"novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["apache","cisco","debian","fedoraproject","oracle"],"products":["cloudcenter","communications_brm_-_elastic_charging_engine","communications_diameter_signaling_router","communications_interactive_session_recorder","communications_offline_mediation_controller","debian_linux","fedora","flexcube_private_banking","health_sciences_data_management_workbench","log4j","policy_automation","policy_automation_for_mobile_devices","primavera_gateway","primavera_p6_enterprise_project_portfolio_management","primavera_unifier","product_lifecycle_analytics","retail_assortment_planning","retail_fiscal_management","retail_order_broker","retail_xstore_point_of_service","siebel_ui_framework","weblogic_server"],"affected":[{"vendor":"apache","product":"log4j","ranges":["≥ 2.0.1 and < 2.3.2","≥ 2.13.0 and < 2.17.1","2.0","≥ 2.4 and < 2.12.4"]},{"vendor":"cisco","product":"cloudcenter","ranges":["4.10.0.16"]},{"vendor":"debian","product":"debian_linux","ranges":["9.0"]},{"vendor":"fedoraproject","product":"fedora","ranges":["35","34"]},{"vendor":"oracle","product":"communications_brm_-_elastic_charging_engine","ranges":["12.0.0.5.0","< 12.0.0.4.6"]},{"vendor":"oracle","product":"communications_diameter_signaling_router","ranges":["≥ 8.0.0.0 and ≤ 8.5.1.0","≥ 8.3.0.0 and ≤ 8.5.1.0"]},{"vendor":"oracle","product":"communications_interactive_session_recorder","ranges":["6.4","6.3"]},{"vendor":"oracle","product":"communications_offline_mediation_controller","ranges":["< 12.0.0.4.4","12.0.0.5.0"]},{"vendor":"oracle","product":"flexcube_private_banking","ranges":["12.1.0"]},{"vendor":"oracle","product":"health_sciences_data_management_workbench","ranges":["3.1.0.3","3.0.0.0","2.5.2.1"]},{"vendor":"oracle","product":"policy_automation","ranges":["≥ 12.2.0 and ≤ 12.2.24"]},{"vendor":"oracle","product":"policy_automation_for_mobile_devices","ranges":["≥ 12.2.0 and ≤ 12.2.24"]},{"vendor":"oracle","product":"primavera_gateway","ranges":["≥ 19.12.0 and ≤ 19.12.12","≥ 20.12.0 and ≤ 20.12.7","≥ 17.12.0 and ≤ 17.12.11","≥ 18.8.0 and ≤ 18.8.13","21.12.0"]},{"vendor":"oracle","product":"primavera_p6_enterprise_project_portfolio_management","ranges":["21.12.0.0","≥ 20.12.0.0 and ≤ 20.12.12.0","≥ 19.12.0 and ≤ 19.12.18.0","≥ 19.12.0.0 and ≤ 19.12.18.0"]},{"vendor":"oracle","product":"primavera_unifier","ranges":["21.12","18.8","19.12","20.12"]},{"vendor":"oracle","product":"product_lifecycle_analytics","ranges":["3.6.1"]},{"vendor":"oracle","product":"retail_assortment_planning","ranges":["16.0.3"]},{"vendor":"oracle","product":"retail_fiscal_management","ranges":["14.2"]},{"vendor":"oracle","product":"retail_order_broker","ranges":["18.0","19.1"]},{"vendor":"oracle","product":"retail_xstore_point_of_service","ranges":["19.0.2","21.0.1","18.0.3","20.0.1","17.0.4"]},{"vendor":"oracle","product":"siebel_ui_framework","ranges":["≤ 21.12","21.12"]},{"vendor":"oracle","product":"weblogic_server","ranges":["14.1.1.0.0","12.2.1.3.0","12.2.1.4.0"]}]}