CVE-2021-4104

high Apache
CVSS v3 Base Score
7.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
72.2%
Exploitation probability in 30 days
Top 1% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Confidentiality
High
Integrity
High
Availability
High
Published: December 14, 2021 (1669 days ago)
Last Modified: May 28, 2026
Vendor: Apache
Source: NVD

Description

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

CWE

CWE-502

Affected Products

apache log4jfedoraproject fedoraredhat codeready studioredhat integration camel kredhat integration camel quarkusredhat jboss a-mqredhat jboss a-mq streamingredhat jboss data gridredhat jboss data virtualizationredhat jboss enterprise application platform

References

🔗 www.openwall.com 🔗 access.redhat.com 🔗 github.com 🔗 psirt.global.sonicwall.com 🔗 security.gentoo.org