FG-IR-21-245: Apache log4j2 log messages substitution (CVE-2021-44228)
Apache Log4j <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled (CVE-2021-44228).
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-21-245?
The severity of FG-IR-21-245 is critical due to the potential for remote code execution.
How do I fix FG-IR-21-245?
To fix FG-IR-21-245, upgrade Apache Log4j to version 2.15.0 or later.
What products are affected by FG-IR-21-245?
FG-IR-21-245 affects Apache Log4j versions up to and including 2.14.1.
What type of vulnerability is FG-IR-21-245?
FG-IR-21-245 is a remote code execution vulnerability caused by JNDI features in Apache Log4j.
Can FG-IR-21-245 be exploited remotely?
Yes, FG-IR-21-245 can be exploited remotely if an attacker can control log messages or parameters.