CVE-2021-44832

MediumCVSS 6.6/10Last modified Jun 17, 2026

Description

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20CWE-74

Affected software

No affected versions have been published.

Timeline

Published
Dec 28, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-448339.8The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file.CVE-2021-448359.8An issue was discovered in Active Intelligent Visualization 5. The Vdc header is used in a SQL query without being sanitized. This causes SQCVE-2021-448364.3An issue was discovered in Delta RM 1.2. The /risque/risque/workflow/reset endpoint is lacking access controls, and it is possible for an unCVE-2021-448374.3An issue was discovered in Delta RM 1.2. It is possible for an unprivileged user to access the same information as an admin user regarding tCVE-2021-448384.3An issue was discovered in Delta RM 1.2. Using the /risque/risque/ajax-details endpoint, with a POST request indicating the risk to access wCVE-2021-448396.5An issue was discovered in Delta RM 1.2. It is possible to request a new password for any other account using the account ID. Using the /lisCVE-2021-448402.7An issue was discovered in Delta RM 1.2. Using an privileged account, it is possible to edit, create, and delete risk labels, such as CriticCVE-2021-448479.8A stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through 0.2.12 (caused by an impCVE-2021-448485.3In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whetCVE-2021-448506.8On Xilinx Zynq-7000 SoC devices, physical modification of an SD boot image allows for a buffer overflow attack in the ROM. Because the Zynq-CVE-2021-448527.8An issue was discovered in BS_RCIO64.sys in Biostar RACING GT Evo 2.1.1905.1700. A low-integrity process can open the driver's device objectCVE-2021-448545.3An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API publicly caches results fro
CVE-2021-44832: Medium severity, CVSS 6.6 | Vulnix