CVE-2021-45046

Published: Dec 14, 2021Modified: Jun 17, 2026CISA KEV

9.0

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 6.0

Source: NVD

Description

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

Affected (90)

Products: Apache: Log4j · Cvat: Computer Vision Annotation Tool · Intel: Audio Development Kit, Datacenter Manager, Genomics Kernel Library, Oneapi, Secure Device Onboard, Sensor Solution Firmware Development Kit, System Debugger, System Studio · +4 more

Show all products

Apache: Log4j · Cvat: Computer Vision Annotation Tool · Intel: Audio Development Kit, Datacenter Manager, Genomics Kernel Library, Oneapi, Secure Device Onboard, Sensor Solution Firmware Development Kit, System Debugger, System Studio · Siemens: Sppa T3000 Ses3000 Firmware, Captial, Comos, Desigo Cc Advanced Reports, Desigo Cc Info Center, E Car Operation Center, Energy Engage, Energyip, Energyip Prepay, Gma Manager, Head End System Universal Device Integration System, Industrial Edge Management, Industrial Edge Management Hub, Logo! Soft Comfort, Mendix, Mindsphere, Navigator, Nx, Opcenter Intelligence, Operation Scheduler, Sentron Powermanager, Siguard Dsa, Sipass Integrated, Siveillance Command, Siveillance Control Pro, Siveillance Identity, Siveillance Vantage, Siveillance Viewpoint, Solid Edge Cam Pro, Solid Edge Harness Design, Spectrum Power 4, Spectrum Power 7, Teamcenter, Tracealertserverplus, Vesys, Xpedition Enterprise, Xpedition Package Integrator, 6bk1602 0aa12 0tp0 Firmware, 6bk1602 0aa22 0tp0 Firmware, 6bk1602 0aa32 0tp0 Firmware, 6bk1602 0aa42 0tp0 Firmware, 6bk1602 0aa52 0tp0 Firmware · Debian: Debian Linux · Sonicwall: Email Security · Fedoraproject: Fedora

Apache

1 product

Log4j

Cvat

1 product

Computer Vision Annotation Tool

Intel

8 products

Audio Development Kit

Datacenter Manager

Genomics Kernel Library

Oneapi

Secure Device Onboard

Sensor Solution Firmware Development Kit

System Debugger

System Studio

Siemens

42 products

Sppa T3000 Ses3000 Firmware

Captial

Comos

Desigo Cc Advanced Reports

Desigo Cc Info Center

E Car Operation Center

Head End System Universal Device Integration System

Industrial Edge Management

Industrial Edge Management Hub

Opcenter Intelligence

Siveillance Control Pro

Siveillance Identity

Siveillance Vantage

Siveillance Viewpoint

Solid Edge Cam Pro

Solid Edge Harness Design

Xpedition Package Integrator

6bk1602 0aa12 0tp0 Firmware

6bk1602 0aa22 0tp0 Firmware

6bk1602 0aa32 0tp0 Firmware

6bk1602 0aa42 0tp0 Firmware

6bk1602 0aa52 0tp0 Firmware

1 product

1 product

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Apache Log4j	From 2.0.1 to 2.12.2
Apache Log4j	From 2.13.0 to 2.16.0
Apache Log4j	Version 2.0
Apache Log4j	Version 2.0 beta9
Apache Log4j	Version 2.0 rc1
Apache Log4j	Version 2.0 rc2

Configuration B

9 vulnerable

Vulnerable Software	Affected Versions
Cvat Computer Vision Annotation Tool	All versions
Intel Audio Development Kit	All versions
Intel Datacenter Manager	All versions
Intel Genomics Kernel Library	All versions
Intel Oneapi	All versions
Intel Secure Device Onboard	All versions
Intel Sensor Solution Firmware Development Kit	All versions
Intel System Debugger	All versions
Intel System Studio	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Sppa T3000 Ses3000 Firmware	All versions

Running on/with	Platform Versions
Siemens Sppa T3000 Ses3000	All versions

Configuration D

64 vulnerable

Vulnerable Software	Affected Versions
Siemens Captial	Before 2019.1
Siemens Captial	Version 2019.1
Siemens Captial	Version 2019.1 sp1912
Siemens Comos	All versions
Siemens Desigo Cc Advanced Reports	Version 4.0
Siemens Desigo Cc Advanced Reports	Version 4.1
Siemens Desigo Cc Advanced Reports	Version 4.2
Siemens Desigo Cc Advanced Reports	Version 5.0
Siemens Desigo Cc Advanced Reports	Version 5.1
Siemens Desigo Cc Info Center	Version 5.0
Siemens Desigo Cc Info Center	Version 5.1
Siemens E Car Operation Center	Before 2021-12-13
Siemens Energy Engage	Version 3.1
Siemens Energyip	Version 8.5
Siemens Energyip	Version 8.6
Siemens Energyip	Version 8.7
Siemens Energyip	Version 9.0
Siemens Energyip Prepay	Version 3.7
Siemens Energyip Prepay	Version 3.8
Siemens Gma Manager	Before 8.6.2j-398
Siemens Head End System Universal Device Integration System	All versions
Siemens Industrial Edge Management	All versions
Siemens Industrial Edge Management Hub	Before 2021-12-13
Siemens Logo! Soft Comfort	All versions
Siemens Mendix	All versions
Siemens Mindsphere	Before 2021-12-11
Siemens Navigator	Before 2021-12-13
Siemens Nx	All versions
Siemens Opcenter Intelligence	Up to 3.2
Siemens Operation Scheduler	Up to 1.1.3
Siemens Sentron Powermanager	Version 4.1
Siemens Sentron Powermanager	Version 4.2
Siemens Siguard Dsa	Version 4.2
Siemens Siguard Dsa	Version 4.3
Siemens Siguard Dsa	Version 4.4
Siemens Sipass Integrated	Version 2.80
Siemens Sipass Integrated	Version 2.85
Siemens Siveillance Command	Up to 4.16.2.1
Siemens Siveillance Control Pro	All versions
Siemens Siveillance Identity	Version 1.5
Siemens Siveillance Identity	Version 1.6
Siemens Siveillance Vantage	All versions
Siemens Siveillance Viewpoint	All versions
Siemens Solid Edge Cam Pro	All versions
Siemens Solid Edge Harness Design	Before 2020
Siemens Solid Edge Harness Design	Version 2020
Siemens Solid Edge Harness Design	Version 2020
Siemens Solid Edge Harness Design	Version 2020 sp2002
Siemens Spectrum Power 4	Before 4.70
Siemens Spectrum Power 4	Version 4.70
Siemens Spectrum Power 4	Version 4.70 sp7
Siemens Spectrum Power 4	Version 4.70 sp8
Siemens Spectrum Power 7	Before 2.30
Siemens Spectrum Power 7	Version 2.30
Siemens Spectrum Power 7	Version 2.30
Siemens Spectrum Power 7	Version 2.30 sp2
Siemens Teamcenter	All versions
Siemens Tracealertserverplus	All versions
Siemens Vesys	Before 2019.1
Siemens Vesys	Version 2019.1
Siemens Vesys	Version 2019.1
Siemens Vesys	Version 2019.1 sp1912
Siemens Xpedition Enterprise	All versions
Siemens Xpedition Package Integrator	All versions

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Sonicwall Email Security	Before 10.0.12

Configuration G

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 34
Fedoraproject Fedora	Version 35

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens 6bk1602 0aa12 0tp0 Firmware	Before 2.7.0

Running on/with	Platform Versions
Siemens 6bk1602 0aa12 0tp0	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens 6bk1602 0aa22 0tp0 Firmware	Before 2.7.0

Running on/with	Platform Versions
Siemens 6bk1602 0aa22 0tp0	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens 6bk1602 0aa32 0tp0 Firmware	Before 2.7.0

Running on/with	Platform Versions
Siemens 6bk1602 0aa32 0tp0	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens 6bk1602 0aa42 0tp0 Firmware	Before 2.7.0

Running on/with	Platform Versions
Siemens 6bk1602 0aa42 0tp0	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens 6bk1602 0aa52 0tp0 Firmware	Before 2.7.0

Running on/with	Platform Versions
Siemens 6bk1602 0aa52 0tp0	All versions

Related CWEs

CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

References (43)

http://www.openwall.com/lists/oss-security/2021/12/14/4

Source: security@apache.org

Mailing ListMitigationThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/12/15/3

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/12/18/1

Source: security@apache.org

Mailing ListThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf

Source: security@apache.org

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf

Source: security@apache.org

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf

Source: security@apache.org

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf

Source: security@apache.org

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/

Source: security@apache.org

Mailing ListRelease Notes

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/

Source: security@apache.org

Mailing ListRelease Notes

https://logging.apache.org/log4j/2.x/security.html

Source: security@apache.org

MitigationRelease NotesVendor Advisory

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032

Source: security@apache.org

Third Party Advisory

https://security.gentoo.org/glsa/202310-16

Source: security@apache.org

Third Party Advisory

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd

Source: security@apache.org

Third Party Advisory

https://www.cve.org/CVERecord?id=CVE-2021-44228

Source: security@apache.org

Not Applicable

https://www.debian.org/security/2021/dsa-5022

Source: security@apache.org

Third Party Advisory

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html

Source: security@apache.org

Third Party Advisory

https://www.kb.cert.org/vuls/id/930724

Source: security@apache.org

Third Party AdvisoryUS Government Resource

https://www.oracle.com/security-alerts/alert-cve-2021-44228.html

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: security@apache.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2021/12/14/4