| CVE ID | CVSS Score | Severity | Description |
|---|---|---|---|
| CVE-2021-45105 | 0.0 | unknown |
CVE-2021-45105. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-referential lookups, when the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, $${ctx:loginId}).
This could allow attackers with control over Thread Context Map (MDC) input data to craft malicious input data that contains a recursive lookup, resulting in a denial of service condition.
|
| CVE-2021-45046 | 0.0 | unknown |
CVE-2021-45046. The fix to address CVE-2021-44228 was incomplete in certain non-default configurations, when the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, ${ctx:loginId}).
This could allow attackers with control over Thread Context Map (MDC) input data to craft malicious input data using a JNDI Lookup pattern, resulting in an information leak and remote code execution in some environments and local code execution in all environments.
|
| CVE-2021-44228 | 10.0 | critical |
The affected product does not properly validate user input, allowing an attacker to enter malicious input and potentially gain remote code execution.CVE-2021-44228 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
|