{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.2.1.2-jre17"}],"component":"com.guicedee.services:log4j-core","cve_ids":["CVE-2021-44228"],"ecosystem":"Maven","exploited":true,"fixed_versions":[],"ghsa_id":"GHSA-jfh8-c2jp-5v3q","id":"tcs_01M5N92RSMEVG6770A2MACTX6M","modified_at":"2025-10-22T19:37:02.616807Z","published_at":"2021-12-10T00:40:56Z","references":["https://osv.dev/vulnerability/GHSA-jfh8-c2jp-5v3q","https://nvd.nist.gov/vuln/detail/CVE-2021-44228","https://github.com/apache/logging-log4j2/pull/608","https://github.com/github/advisory-database/pull/5501","https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf","https://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html","https://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html","https://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html","https://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://seclists.org/fulldisclosure/2022/Dec/2","https://seclists.org/fulldisclosure/2022/Jul/11","https://seclists.org/fulldisclosure/2022/Mar/23","https://security.netapp.com/advisory/ntap-20211210-0007","https://support.apple.com/kb/HT213189","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://twitter.com/kurtseifried/status/1469345530182455296","https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228","https://www.debian.org/security/2021/dsa-5020","https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html","https://www.kb.cert.org/vuls/id/930724","https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html","https://www.oracle.com/security-alerts/alert-cve-2021-44228.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf","https://github.com/advisories/GHSA-7rjr-3q55-vv33","https://github.com/apache/logging-log4j2","https://github.com/cisagov/log4j-affected-db","https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md","https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228","https://github.com/tangxiaofeng7/apache-log4j-poc","https://issues.apache.org/jira/browse/LOG4J2-3198","https://issues.apache.org/jira/browse/LOG4J2-3201","https://issues.apache.org/jira/browse/LOG4J2-3214","https://issues.apache.org/jira/browse/LOG4J2-3221","https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM","https://logging.apache.org/log4j/2.x/changes-report.html#a2.15.0","https://logging.apache.org/log4j/2.x/manual/lookups.html#JndiLookup","https://logging.apache.org/log4j/2.x/manual/migration.html","https://logging.apache.org/log4j/2.x/security.html","https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2","http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html","http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html","http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html","http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html","http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html","http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html","http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html","http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html","http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html","http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html","http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html","http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html","http://seclists.org/fulldisclosure/2022/Dec/2","http://seclists.org/fulldisclosure/2022/Jul/11","http://seclists.org/fulldisclosure/2022/Mar/23","http://www.openwall.com/lists/oss-security/2021/12/10/1","http://www.openwall.com/lists/oss-security/2021/12/10/2","http://www.openwall.com/lists/oss-security/2021/12/10/3","http://www.openwall.com/lists/oss-security/2021/12/13/1","http://www.openwall.com/lists/oss-security/2021/12/13/2","http://www.openwall.com/lists/oss-security/2021/12/14/4","http://www.openwall.com/lists/oss-security/2021/12/15/3"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-jfh8-c2jp-5v3q#Maven/com.guicedee.services:log4j-core","url":"https://osv.dev/vulnerability/GHSA-jfh8-c2jp-5v3q"},{"source":"kev","source_id":"CVE-2021-44228","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"Remote code injection in Log4j"}