Vulnerability Details : CVE-2021-45046

Public exploit exists!
Used for ransomware!
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
Published 2021-12-14 19:15:08
Updated 2025-03-12 19:52:00
Source Apache Software Foundation
View at NVD,   CVE.org
Vulnerability category: Execute code

Products affected by CVE-2021-45046

CVE-2021-45046 is in the CISA Known Exploited Vulnerabilities Catalog

This issue is known to have been leveraged as part of a ransomware campaign.
CISA vulnerability name:
Apache Log4j2 Deserialization of Untrusted Data Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.
Notes:
https://logging.apache.org/log4j/2.x/security.html; https://nvd.nist.gov/vuln/detail/CVE-2021-45046
Added on 2023-05-01 Action due date 2023-05-22

Exploit prediction scoring system (EPSS) score for CVE-2021-45046

EPSS FAQ
94.31%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2021-45046

  • Log4Shell HTTP Scanner
    Disclosure Date: 2021-12-09
    First seen: 2022-12-23
    auxiliary/scanner/http/log4shell_scanner
    Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in configuration, log messages, and parameters, do not protect against attacker controlled LDAP and other JNDI related endpoints. This module will scan an HTTP end point for the Log4Shell vu

CVSS scores for CVE-2021-45046

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
5.1
 MEDIUM AV:N/AC:H/Au:N/C:P/I:P/A:P
4.9
6.4
 NIST
9.0
 CRITICAL CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
2.2
6.0
 134c704f-9b21-4f2e-91b3-4a467353bcc0 2025-02-04
9.0
 CRITICAL CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
2.2
6.0
 NIST

CWE ids for CVE-2021-45046

References for CVE-2021-45046

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close