Apache Software Foundation Apache Log4j2
3 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2021-44832 | log4j-core – < 2.17.1 | Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration | MEDIUM 6.6 | 98 % | ||
| CVE-2021-45105 | log4j-core – < 2.17.0 | Apache Log4j2 does not always protect from infinite recursion in lookup evaluation | MEDIUM 5.9 | 100 % | ||
| CVE-2021-44228 | 2.0-beta9 – < log4j-core* | Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints | CRITICAL 10.0 | 100 % | KEV |