← Back

CVE-2022-23302

nvd nist
Published: Jan 18, 2022Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Affected (40)

Products: Apache: Log4j · Netapp: Snapmanager · Broadcom: Brocade Sannav · +2 more
Show all products
Apache: Log4j · Netapp: Snapmanager · Broadcom: Brocade Sannav · Qos: Reload4j · Oracle: Advanced Supply Chain Planning, Business Intelligence, Business Process Management Suite, Communications Eagle Ftp Table Base Retrieval, Communications Instant Messaging Server, Communications Messaging Server, Communications Network Integrity, Communications Offline Mediation Controller, Communications Unified Inventory Management, E Business Suite Cloud Manager And Cloud Backup Module, Enterprise Manager Base Platform, Financial Services Revenue Management And Billing Analytics, Healthcare Foundation, Hyperion Data Relationship Management, Hyperion Infrastructure Technology, Identity Management Suite, Identity Manager Connector, Jdeveloper, Middleware Common Libraries And Tools, Mysql Enterprise Monitor, Tuxedo, Weblogic Server
Apache
1 product
Log4j
Netapp
1 product
Snapmanager
Broadcom
1 product
Brocade Sannav
Qos
1 product
Reload4j
Oracle
22 products
Advanced Supply Chain Planning
Business Intelligence
Business Process Management Suite
Communications Eagle Ftp Table Base Retrieval
Communications Instant Messaging Server
Communications Messaging Server
Communications Network Integrity
Communications Offline Mediation Controller
Communications Unified Inventory Management
E Business Suite Cloud Manager And Cloud Backup Module
Enterprise Manager Base Platform
Financial Services Revenue Management And Billing Analytics
Healthcare Foundation
Hyperion Data Relationship Management
Hyperion Infrastructure Technology
Identity Management Suite
Identity Manager Connector
Jdeveloper
Middleware Common Libraries And Tools
Mysql Enterprise Monitor
Tuxedo
Weblogic Server
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Log4j
From 1.0.1 to 1.2.17
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Netapp
Snapmanager
All versions
Snapmanager
All versions
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Brocade Sannav
All versions
Configuration D
1 vulnerable
Vulnerable SoftwareAffected Versions
Reload4j
Before 1.2.18.1
Configuration E
35 vulnerable
Vulnerable SoftwareAffected Versions
Oracle
Advanced Supply Chain Planning
Version 12.1
Advanced Supply Chain Planning
Version 12.2
Oracle
Business Intelligence
Version 12.2.1.3.0
Business Intelligence
Version 12.2.1.4.0
Business Intelligence
Version 5.9.0.0.0
Oracle
Business Process Management Suite
Version 12.2.1.3.0
Business Process Management Suite
Version 12.2.1.4.0
Communications Eagle Ftp Table Base Retrieval
Version 4.5
Communications Instant Messaging Server
Version 10.0.1.5.0
Communications Messaging Server
Version 8.1
Communications Network Integrity
Version 7.3.6
Oracle
Communications Offline Mediation Controller
Before 12.0.0.4.4
Communications Offline Mediation Controller
Version 12.0.0.5.0
Oracle
Communications Unified Inventory Management
Version 7.4.1
Communications Unified Inventory Management
Version 7.4.2
Oracle
E Business Suite Cloud Manager And Cloud Backup Module
Before 2.2.1.1.1
E Business Suite Cloud Manager And Cloud Backup Module
Version 2.2.1.1.1
Oracle
Enterprise Manager Base Platform
Version 13.4.0.0
Enterprise Manager Base Platform
Version 13.5.0.0
Oracle
Financial Services Revenue Management And Billing Analytics
Version 2.7.0.0
Financial Services Revenue Management And Billing Analytics
Version 2.7.0.1
Financial Services Revenue Management And Billing Analytics
Version 2.8.0.0
Healthcare Foundation
Version 8.1.0
Hyperion Data Relationship Management
Before 11.2.8.0
Hyperion Infrastructure Technology
Before 11.2.8.0
Oracle
Identity Management Suite
Version 12.2.1.3.0
Identity Management Suite
Version 12.2.1.4.0
Identity Manager Connector
Version 11.1.1.5.0
Jdeveloper
Version 12.2.1.3.0
Middleware Common Libraries And Tools
Version 12.2.1.4.0
Mysql Enterprise Monitor
Up to 8.0.29
Tuxedo
Version 12.2.2.0.0
Oracle
Weblogic Server
Version 12.2.1.3.0
Weblogic Server
Version 12.2.1.4.0
Weblogic Server
Version 14.1.1.0.0

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (14)

Source: security@apache.org
Mailing ListThird Party Advisory
Source: security@apache.org
Mailing ListMitigationVendor Advisory
Source: security@apache.org
Vendor Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListMitigationVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.