CVE-2022-23305: SQL Injection

First published: Tue Jan 18 2022(Updated: )

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Credit: security@apache.org security@apache.org

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-cve
• collector/ibm-support
• collector/github-advisory-latest
• alias/GHSA-65fg-84f6-3jq3
• alias/CVE-2022-23305
• collector/github-advisory
• zeroday/true
• agent/type
• agent/first-publish-date
• agent/last-modified-date
• collector/launchpad-cve
• source/Launchpad
• collector/redhat-bugzilla
• source/Red Hat
• agent/author
• collector/security-tracker-debian
• source/Debian
• agent/software-canonical-lookup
• agent/weakness
• agent/remedy
• agent/severity
• agent/description
• agent/event
• collector/usn-cve
• source/Ubuntu
• agent/references
• agent/softwarecombine
• agent/tags
• collector/nvd-index
• agent/software-canonical-lookup-request
• collector/nvd-cve
• source/NVD
• package-manager/redhat
• vendor/ibm
• canonical/ibm qradar siem
• version/ibm qradar siem/7.5 - 7.5.0 up7
• package-manager/maven
• vendor/apache
• canonical/apache log4j
• version/apache log4j/2.0-beta9
• version/apache log4j/2.15.0
• version/apache log4j/2.17.0
• version/apache log4j/1.2.x
• package-manager/debian
• package-manager/ubuntu
• version/apache log4j/1.2
• version/apache log4j/1.2.17
• vendor/netapp
• canonical/netapp snapmanager oracle
• canonical/netapp snapmanager sap
• vendor/broadcom
• canonical/broadcom brocade sannav
• vendor/qos
• canonical/qos reload4j
• vendor/oracle
• canonical/oracle advanced supply chain planning
• version/oracle advanced supply chain planning/12.1
• version/oracle advanced supply chain planning/12.2
• canonical/oracle business intelligence
• version/oracle business intelligence/5.9.0.0.0
• version/oracle business intelligence/12.2.1.3.0
• version/oracle business intelligence/12.2.1.4.0
• canonical/oracle business process management suite
• version/oracle business process management suite/12.2.1.3.0
• version/oracle business process management suite/12.2.1.4.0
• canonical/oracle communications eagle ftp table base retrieval
• version/oracle communications eagle ftp table base retrieval/4.5
• canonical/oracle communications instant messaging server
• version/oracle communications instant messaging server/10.0.1.5.0
• canonical/oracle communications messaging server
• version/oracle communications messaging server/8.1
• canonical/oracle communications network integrity
• version/oracle communications network integrity/7.3.6
• canonical/oracle communications offline mediation controller
• version/oracle communications offline mediation controller/12.0.0.5.0
• canonical/oracle communications unified inventory management
• version/oracle communications unified inventory management/7.4.1
• version/oracle communications unified inventory management/7.4.2
• canonical/oracle e-business suite cloud manager and cloud backup module
• version/oracle e-business suite cloud manager and cloud backup module/2.2.1.1.1
• canonical/oracle e-business suite information discovery
• version/oracle e-business suite information discovery/12.2.3
• version/oracle e-business suite information discovery/12.2.11
• canonical/oracle enterprise manager base platform
• version/oracle enterprise manager base platform/13.4.0.0
• version/oracle enterprise manager base platform/13.5.0.0
• canonical/oracle financial services revenue management and billing analytics
• version/oracle financial services revenue management and billing analytics/2.7.0.0
• version/oracle financial services revenue management and billing analytics/2.7.0.1
• version/oracle financial services revenue management and billing analytics/2.8.0.0
• canonical/oracle healthcare foundation
• version/oracle healthcare foundation/8.1.0
• canonical/oracle hyperion data relationship management
• canonical/oracle hyperion infrastructure technology
• canonical/oracle identity management suite
• version/oracle identity management suite/12.2.1.3.0
• version/oracle identity management suite/12.2.1.4.0
• canonical/oracle identity manager connector
• version/oracle identity manager connector/11.1.1.5.0
• canonical/oracle jdeveloper
• version/oracle jdeveloper/12.2.1.3.0
• canonical/oracle middleware common libraries and tools
• version/oracle middleware common libraries and tools/12.2.1.4.0
• canonical/oracle mysql enterprise monitor
• version/oracle mysql enterprise monitor/8.0.29
• canonical/oracle retail extract transform and load
• version/oracle retail extract transform and load/13.2.5
• canonical/oracle tuxedo
• version/oracle tuxedo/12.2.2.0.0
• canonical/oracle weblogic server
• version/oracle weblogic server/12.2.1.3.0
• version/oracle weblogic server/12.2.1.4.0
• version/oracle weblogic server/14.1.1.0.0