Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
CVSS 3.x
| Source | Score | Severity | Vector | Exploitability | Impact |
|---|---|---|---|---|---|
| nvd@nist.gov | 10.0 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | 3.9 | 6.0 |
CVSS 2.0
Severity: HIGH
Problem Type: CWE-20,CWE-400,CWE-502,CWE-917,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| cisco | virtual_topology_system | 2.6.6 |
| cisco | unified_communications_manager_im_and_presence_service | * |
| siemens | solid_edge_harness_design | * |
| cisco | unified_contact_center_express | * |
| cisco | dna_spaces | - |
| siemens | 6bk1602-0aa32-0tp0_firmware | * |
| cisco | packaged_contact_center_enterprise | * |
| siemens | energyip | 8.6 |
| siemens | siguard_dsa | 4.4 |
| siemens | xpedition_package_integrator | - |
| cisco | virtualized_infrastructure_manager | * |
| cisco | fxos | 7.0.0 |
| cisco | paging_server | 14.0(1) |
| cisco | fxos | 7.1.0 |
| siemens | energyip_prepay | 3.7 |
| siemens | sentron_powermanager | 4.1 |
| cisco | fxos | 6.2.3 |
| siemens | sipass_integrated | 2.85 |
| siemens | siguard_dsa | 4.2 |
| cisco | enterprise_chat_and_email | 12.6(1) |
| cisco | ucs_central_software | 2.0(1k) |
| siemens | energyip_prepay | 3.8 |
| siemens | siveillance_identity | 1.5 |
| cisco | finesse | 12.6(1) |
| cisco | connected_analytics_for_network_deployment | 008.000.000 |
| siemens | navigator | * |
| cisco | ucs_director | * |
| cisco | crosswork_optimization_engine | 3.0.0 |
| cisco | ucs_central_software | 2.0(1h) |
| cisco | connected_analytics_for_network_deployment | 007.003.000 |
| cisco | unified_contact_center_enterprise | 12.6(2) |
| siemens | desigo_cc_advanced_reports | 3.0 |
| intel | data_center_manager | * |
| siemens | siveillance_command | * |
| cisco | connected_analytics_for_network_deployment | 006.005.000.000 |
| siemens | industrial_edge_management | * |
| cisco | intersight_virtual_appliance | * |
| cisco | wan_automation_engine | 7.5 |
| cisco | unified_communications_manager | 11.5(1) |
| cisco | connected_analytics_for_network_deployment | 007.001.000 |
| cisco | ucs_central_software | 2.0(1a) |
| cisco | firepower_threat_defense | 7.0.0 |
| cisco | crosswork_network_automation | - |
| cisco | unified_communications_manager | 11.5(1.17900.52) |
| cisco | firepower_threat_defense | 6.4.0 |
| cisco | webex_meetings_server | * |
| cisco | identity_services_engine | 003.001(000.518) |
| netapp | active_iq_unified_manager | - |
| intel | sensor_solution_firmware_development_kit | - |
| cisco | sd-wan_vmanage | 20.6.1 |
| cisco | unified_contact_center_enterprise | 12.6(1) |
| cisco | wan_automation_engine | 7.4 |
| siemens | energyip | 8.7 |
| netapp | ontap_tools | - |
| cisco | unified_customer_voice_portal | * |
| siemens | operation_scheduler | * |
| cisco | cyber_vision_sensor_management_extension | 4.0.2 |
| cisco | wan_automation_engine | 7.2.1 |
| snowsoftware | vm_access_proxy | * |
| cisco | identity_services_engine | 003.000(000.458) |
| cisco | crosswork_network_automation | 4.1.1 |
| siemens | 6bk1602-0aa22-0tp0_firmware | * |
| netapp | cloud_secure_agent | - |
| cisco | unified_computing_system | 006.008(001.000) |
| cisco | video_surveillance_manager | 7.14(2.26) |
| cisco | video_surveillance_manager | 7.14(3.025) |
| cisco | common_services_platform_collector | 002.010(000.000) |
| siemens | e-car_operation_center | * |
| cisco | business_process_automation | * |
| cisco | nexus_insights | * |
| cisco | unified_communications_manager_im_&_presence_service | 11.5(1) |
| cisco | unified_contact_center_enterprise | 12.5(1) |
| cisco | webex_meetings_server | 3.0 |
| cisco | data_center_network_manager | 11.3(1) |
| cisco | unified_intelligence_center | 12.6(1) |
| cisco | unified_customer_voice_portal | 12.5(1) |
| cisco | network_dashboard_fabric_controller | 11.5(1) |
| siemens | desigo_cc_advanced_reports | 5.0 |
| cisco | connected_analytics_for_network_deployment | 7.3 |
| siemens | mendix | * |
| cisco | cloudcenter_suite | 5.3(0) |
| cisco | network_dashboard_fabric_controller | 11.4(1) |
| cisco | ucs_central_software | 2.0(1b) |
| siemens | 6bk1602-0aa42-0tp0_firmware | * |
| siemens | spectrum_power_7 | * |
| cisco | evolved_programmable_network_manager | * |
| fedoraproject | fedora | 34 |
| cisco | emergency_responder | 11.5 |
| cisco | video_surveillance_manager | 7.14(4.018) |
| siemens | sentron_powermanager | 4.2 |
| siemens | vesys | 2019.1 |
| cisco | ucs_central_software | 2.0(1g) |
| cisco | unified_communications_manager | 11.5(1.22900.28) |
| cisco | evolved_programmable_network_manager | 3.1 |
| siemens | capital | * |
| cisco | unified_communications_manager | * |
| cisco | fxos | 6.7.0 |
| siemens | energyip_prepay | * |
| cisco | smart_phy | 21.3 |
| cisco | network_insights_for_data_center | 6.0(2.1914) |
| cisco | ucs_central | * |
| cisco | firepower_threat_defense | 6.3.0 |
| siemens | desigo_cc_info_center | 5.1 |
| cisco | connected_analytics_for_network_deployment | 007.000.001 |
| cisco | customer_experience_cloud_agent | * |
| cisco | video_surveillance_operations_manager | * |
| intel | audio_development_kit | - |
| siemens | desigo_cc_info_center | 5.0 |
| cisco | evolved_programmable_network_manager | 3.0 |
| cisco | paging_server | 8.5(1) |
| cisco | ucs_central_software | 2.0 |
| cisco | crosswork_zero_touch_provisioning | * |
| cisco | finesse | 12.5(1) |
| cisco | firepower_threat_defense | 6.5.0 |
| siemens | energyip | 9.0 |
| cisco | unified_communications_manager_im_&_presence_service | 11.5(1.22900.6) |
| cisco | cloudcenter_workload_manager | * |
| cisco | iot_operations_dashboard | - |
| cisco | dna_center | 2.2.2.8 |
| siemens | desigo_cc_advanced_reports | 4.1 |
| cisco | unified_customer_voice_portal | 12.5 |
| cisco | mobility_services_engine | - |
| cisco | prime_service_catalog | 12.1 |
| cisco | smart_phy | 3.1.2 |
| cisco | cloudcenter_suite | 4.10.0.15 |
| cisco | cloudcenter_suite_admin | * |
| cisco | crosswork_network_automation | 3.0.0 |
| siemens | mindsphere | * |
| siemens | siveillance_viewpoint | * |
| siemens | sppa-t3000_ses3000_firmware | * |
| cisco | enterprise_chat_and_email | 12.5(1) |
| cisco | identity_services_engine | * |
| netapp | solidfire_enterprise_sds | - |
| cisco | network_dashboard_fabric_controller | 11.5(3) |
| cisco | broadworks | - |
| cisco | wan_automation_engine | 7.2.3 |
| cisco | unified_intelligence_center | 12.6(2) |
| cisco | cx_cloud_agent | 001.012 |
| cisco | sd-wan_vmanage | 20.7 |
| cisco | finesse | * |
| cisco | firepower_threat_defense | 6.6.0 |
| siemens | vesys | 2020.1 |
| siemens | siveillance_vantage | * |
| intel | system_debugger | - |
| cisco | virtual_topology_system | * |
| cisco | paging_server | 8.3(1) |
| cisco | network_services_orchestrator | - |
| cisco | common_services_platform_collector | 002.009(001.002) |
| cisco | connected_analytics_for_network_deployment | 007.003.001.001 |
| cisco | dna_center | * |
| cisco | connected_analytics_for_network_deployment | 006.005.000. |
| cisco | unified_contact_center_management_portal | 12.6(1) |
| cisco | unified_customer_voice_portal | 12.0 |
| cisco | cloudcenter_suite | 5.4(1) |
| cisco | network_assurance_engine | 6.0(2.1912) |
| cisco | sd-wan_vmanage | 20.3 |
| siemens | industrial_edge_management_hub | * |
| cisco | webex_meetings_server | 4.0 |
| cisco | paging_server | 9.1(1) |
| cisco | integrated_management_controller_supervisor | * |
| siemens | solid_edge_harness_design | 2020 |
| cisco | unified_sip_proxy | * |
| cisco | crosswork_optimization_engine | * |
| debian | debian_linux | 9.0 |
| cisco | crosswork_data_gateway | 3.0.0 |
| cisco | paging_server | 9.0(1) |
| siemens | spectrum_power_4 | * |
| siemens | xpedition_enterprise | - |
| cisco | smart_phy | 3.1.5 |
| cisco | connected_analytics_for_network_deployment | 008.000.000.000.004 |
| siemens | vesys | * |
| cisco | network_assurance_engine | * |
| cisco | crosswork_network_controller | * |
| cisco | smart_phy | 3.1.3 |
| cisco | unity_connection | * |
| siemens | siguard_dsa | * |
| siemens | siguard_dsa | 4.3 |
| cisco | evolved_programmable_network_manager | 4.1 |
| cisco | paging_server | 8.4(1) |
| cisco | cloudcenter_suite | 5.5.0 |
| percussion | rhythmyx | * |
| cisco | common_services_platform_collector | 002.009(000.002) |
| cisco | firepower_threat_defense | 7.1.0 |
| debian | debian_linux | 11.0 |
| cisco | network_dashboard_fabric_controller | 11.0(1) |
| cisco | emergency_responder | * |
| netapp | cloud_manager | - |
| apache | log4j | * |
| cisco | network_dashboard_fabric_controller | 11.5(2) |
| cisco | cyber_vision | 4.0.2 |
| cisco | emergency_responder | 11.5(4.66000.14) |
| cisco | sd-wan_vmanage | 20.5 |
| netapp | cloud_insights | - |
| cisco | unified_customer_voice_portal | 11.6(1) |
| cisco | connected_mobile_experiences | - |
| cisco | emergency_responder | 11.5(4.65000.14) |
| bentley | synchro_4d | * |
| cisco | cloudcenter_suite | 5.5(1) |
| cisco | evolved_programmable_network_manager | 5.0 |
| cisco | identity_services_engine | 002.004(000.914) |
| siemens | vesys | 2021.1 |
| cisco | integrated_management_controller_supervisor | 002.003(002.000) |
| intel | system_studio | - |
| cisco | workload_optimization_manager | * |
| cisco | paging_server | 12.5(2) |
| cisco | connected_analytics_for_network_deployment | 007.003.003 |
| cisco | crosswork_platform_infrastructure | 4.1.0 |
| cisco | unified_contact_center_enterprise | 11.6(2) |
| cisco | sd-wan_vmanage | 20.6 |
| cisco | sd-wan_vmanage | * |
| cisco | ucs_central_software | 2.0(1f) |
| cisco | unified_contact_center_express | 12.6(2) |
| intel | secure_device_onboard | - |
| cisco | prime_service_catalog | * |
| cisco | evolved_programmable_network_manager | 5.1 |
| netapp | brocade_san_navigator | - |
| intel | datacenter_manager | * |
| cisco | cloudcenter_suite | 5.3.0 |
| siemens | solid_edge_cam_pro | * |
| cisco | data_center_network_manager | * |
| cisco | common_services_platform_collector | 002.009(000.001) |
| cisco | smart_phy | 3.2.1 |
| siemens | nx | * |
| siemens | 6bk1602-0aa52-0tp0_firmware | * |
| cisco | firepower_threat_defense | 6.7.0 |
| siemens | desigo_cc_advanced_reports | 4.2 |
| bentley | synchro | * |
| cisco | fxos | 6.6.0 |
| cisco | contact_center_management_portal | * |
| cisco | crosswork_network_automation | 4.1.0 |
| cisco | cloudcenter_suite | 5.4.1 |
| cisco | unity_connection | 11.5(1.10000.6) |
| cisco | paging_server | 9.0(2) |
| siemens | captial | * |
| cisco | integrated_management_controller_supervisor | 2.3.2.0 |
| intel | genomics_kernel_library | - |
| cisco | contact_center_domain_manager | * |
| netapp | solidfire_&_hci_storage_node | - |
| siemens | desigo_cc_advanced_reports | 4.0 |
| cisco | sd-wan_vmanage | 20.8 |
| cisco | unified_contact_center_enterprise | 12.0(1) |
| cisco | cloudcenter_suite | 5.5(0) |
| siemens | sipass_integrated | 2.80 |
| cisco | video_surveillance_manager | 7.14(1.26) |
| siemens | teamcenter | * |
| cisco | common_services_platform_collector | 002.009(001.000) |
| snowsoftware | snow_commander | * |
| siemens | energyip | 8.5 |
| cisco | fxos | 6.3.0 |
| cisco | unified_contact_center_express | 12.6(1) |
| cisco | unified_customer_voice_portal | 12.6(1) |
| apple | xcode | * |
| cisco | unified_contact_center_enterprise | * |
| cisco | connected_analytics_for_network_deployment | 007.002.000 |
| cisco | fog_director | - |
| cisco | identity_services_engine | 002.007(000.356) |
| cisco | enterprise_chat_and_email | 12.0(1) |
| cisco | wan_automation_engine | 7.1.3 |
| intel | oneapi_sample_browser | - |
| siemens | capital | 2019.1 |
| cisco | network_services_orchestrator | * |
| cisco | ucs_central_software | 2.0(1l) |
| cisco | packaged_contact_center_enterprise | 11.6(1) |
| cisco | unified_communications_manager | 11.5(1.18900.97) |
| cisco | fxos | 6.5.0 |
| cisco | common_services_platform_collector | 002.009(000.000) |
| siemens | siveillance_identity | 1.6 |
| cisco | firepower_threat_defense | 6.2.3 |
| cisco | unity_connection | 11.5 |
| cisco | unified_communications_manager_im_and_presence_service | 11.5(1) |
| cisco | virtualized_voice_browser | * |
| siemens | spectrum_power_7 | 2.30 |
| cisco | common_services_platform_collector | * |
| siemens | energy_engage | 3.1 |
| cisco | paging_server | * |
| cisco | ucs_central_software | 2.0(1e) |
| siemens | captial | 2019.1 |
| cisco | dna_spaces_connector | - |
| siemens | 6bk1602-0aa12-0tp0_firmware | * |
| cisco | unified_intelligence_center | * |
| cisco | identity_services_engine | 003.002(000.116) |
| cisco | smart_phy | 3.1.4 |
| cisco | unified_sip_proxy | 010.000(001) |
| cisco | enterprise_chat_and_email | * |
| cisco | network_dashboard_fabric_controller | 11.1(1) |
| cisco | unified_communications_manager | 11.5(1.21900.40) |
| cisco | crosswork_zero_touch_provisioning | 3.0.0 |
| cisco | unified_communications_manager | 11.5(1)su3 |
| sonicwall | email_security | * |
| siemens | spectrum_power_4 | 4.70 |
| cisco | automated_subsea_tuning | * |
| cisco | wan_automation_engine | 7.6 |
| cisco | unified_contact_center_express | 12.5(1) |
| intel | computer_vision_annotation_tool | - |
| cisco | connected_analytics_for_network_deployment | 006.004.000.003 |
| siemens | siveillance_control_pro | * |
| cisco | identity_services_engine | 2.4.0 |
| siemens | head-end_system_universal_device_integration_system | * |
| cisco | optical_network_controller | * |
| cisco | wan_automation_engine | 7.2.2 |
| cisco | unified_sip_proxy | 010.002(001) |
| cisco | common_services_platform_collector | 002.009(001.001) |
| cisco | cloudcenter_cost_optimizer | * |
| debian | debian_linux | 10.0 |
| cisco | dna_spaces:_connector | * |
| siemens | comos | * |
| cisco | cloudcenter | * |
| cisco | unified_workforce_optimization | 11.5(1) |
| cisco | automated_subsea_tuning | 02.01.00 |
| siemens | opcenter_intelligence | * |
| cisco | unified_customer_voice_portal | 11.6 |
| cisco | wan_automation_engine | * |
| siemens | gma-manager | * |
| cisco | network_dashboard_fabric_controller | 11.3(1) |
| cisco | network_dashboard_fabric_controller | 11.2(1) |
| cisco | identity_services_engine | 002.006(000.156) |
| cisco | unified_communications_manager | 11.5(1.18119.2) |
| cisco | ucs_central_software | 2.0(1c) |
| cisco | broadworks | * |
| cisco | sd-wan_vmanage | 20.4 |
| cisco | crosswork_network_automation | 2.0.0 |
| cisco | unified_workforce_optimization | * |
| cisco | unified_customer_voice_portal | 12.0(1) |
| cisco | unified_sip_proxy | 010.000(000) |
| cisco | crosswork_platform_infrastructure | * |
| cisco | fxos | 6.4.0 |
| cisco | optical_network_controller | 1.1 |
| netapp | oncommand_insight | - |
| cisco | evolved_programmable_network_manager | 4.0 |
| cisco | unified_sip_proxy | 010.002(000) |
| cisco | wan_automation_engine | 7.3 |
| siemens | logo!_soft_comfort | * |
| cisco | nexus_dashboard | * |
| cisco | cloud_connect | * |
| cisco | cyber_vision_sensor_management_extension | * |
| fedoraproject | fedora | 35 |
| cisco | cloudcenter_suite | 5.5.1 |
| cisco | advanced_malware_protection_virtual_private_cloud_appliance | * |
| cisco | ucs_central_software | 2.0(1d) |
| siemens | desigo_cc_advanced_reports | 5.1 |
| cisco | cloudcenter_suite | 4.10(0.15) |
| cisco | intersight_virtual_appliance | 1.0.9-343 |
| cisco | smart_phy | * |
| apache | log4j | 2.0 |
| cisco | crosswork_data_gateway | * |
| netapp | snapcenter | - |
| cisco | crosswork_network_controller | 3.0.0 |