8.8
CVSSv3

CVE-2022-23302

Published: 18/01/2022 Updated: 24/02/2023
CVSS v2 Base Score: 6 | Impact Score: 6.4 | Exploitability Score: 6.8
CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8
VMScore: 538
Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P

Vulnerability Summary

A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSSink in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote malicious user to execute code on the server if JMSSink is deployed and has been configured to perform JNDI requests. (CVE-2022-23302) A flaw was found in the Java logging library Apache Log4j in version 1.x. JDBCAppender in Log4j 1.x is vulnerable to SQL injection in untrusted data. This allows a remote malicious user to run SQL statements in the database if the deployed application is configured to use JDBCAppender with certain interpolation tokens. (CVE-2022-23305) A flaw was found in the log4j 1.x chainsaw component, where the contents of certain log entries are deserialized and possibly permit code execution. This flaw allows an malicious user to send a malicious request with serialized data to the server to be deserialized when the chainsaw component is run. (CVE-2022-23307)

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache log4j

netapp snapmanager -

broadcom brocade sannav -

qos reload4j

oracle weblogic server 12.2.1.3.0

oracle business intelligence 12.2.1.3.0

oracle business process management suite 12.2.1.3.0

oracle jdeveloper 12.2.1.3.0

oracle identity management suite 12.2.1.3.0

oracle business intelligence 12.2.1.4.0

oracle weblogic server 12.2.1.4.0

oracle weblogic server 14.1.1.0.0

oracle enterprise manager base platform 13.4.0.0

oracle communications network integrity 7.3.6

oracle business process management suite 12.2.1.4.0

oracle advanced supply chain planning 12.2

oracle advanced supply chain planning 12.1

oracle communications unified inventory management 7.4.1

oracle enterprise manager base platform 13.5.0.0

oracle communications messaging server 8.1

oracle business intelligence 5.9.0.0.0

oracle healthcare foundation 8.1.0

oracle communications eagle ftp table base retrieval 4.5

oracle identity manager connector 11.1.1.5.0

oracle communications unified inventory management 7.4.2

oracle communications instant messaging server 10.0.1.5.0

oracle middleware common libraries and tools 12.2.1.4.0

oracle identity management suite 12.2.1.4.0

oracle financial services revenue management and billing analytics 2.7.0.0

oracle hyperion data relationship management

oracle financial services revenue management and billing analytics 2.8.0.0

oracle mysql enterprise monitor

oracle hyperion infrastructure technology

oracle tuxedo 12.2.2.0.0

oracle e-business suite cloud manager and cloud backup module

oracle e-business suite cloud manager and cloud backup module 2.2.1.1.1

oracle financial services revenue management and billing analytics 2.7.0.1

oracle communications offline mediation controller 12.0.0.5.0

oracle communications offline mediation controller

Vendor Advisories

Debian Bug report logs - #1004482 liblog4j12-java: CVE-2022-23307 CVE-2022-23305 CVE-2022-23302 Package: liblog4j12-java; Maintainer for liblog4j12-java is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Source for liblog4j12-java is src:apache-log4j12 (PTS, buildd, popcon) Reported by: Christoph ...
A flaw was found in the Java logging library Apache Log4j in version 1x JMSSink in Log4j 1x is vulnerable to deserialization of untrusted data This allows a remote attacker to execute code on the server if JMSSink is deployed and has been configured to perform JNDI requests (CVE-2022-23302) A flaw was found in the Java logging library Apache L ...
A flaw was found in the Java logging library Apache Log4j in version 1x JMSSink in Log4j 1x is vulnerable to deserialization of untrusted data This allows a remote attacker to execute code on the server if JMSSink is deployed and has been configured to perform JNDI requests (CVE-2022-23302) A flaw was found in the Java logging library Apache L ...
Synopsis Moderate: Red Hat Single Sign-On 7410 security update Type/Severity Security Advisory: Moderate Topic A security update is now available for Red Hat Single Sign-On 74 from the Customer PortalRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base sc ...
Synopsis Important: log4j security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for log4j is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support, Red Hat Enterprise Linux 7, Red Hat ...
Synopsis Important: parfait:05 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the parfait:05 module is now available for Red Hat Enterprise Linux 82 Extended Update SupportRed Hat Produc ...
Synopsis Low: Red Hat JBoss Web Server 31 Service Pack 14 security update Type/Severity Security Advisory: Low Topic An update is now available for Red Hat JBoss Web Server 31 for Red Hat Enterprise Linux 7 and Microsoft WindowsRed Hat Product Security has rated this release as having a security impact of Low A Common Vulnerability Scorin ...
Synopsis Low: Red Hat JBoss Web Server 31 Service Pack 14 Security Update Type/Severity Security Advisory: Low Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update is now available for Red Hat JBoss Web Server 31 for Red Hat Enterprise Linux 7Red Hat Produ ...
Synopsis Important: Red Hat JBoss Data Virtualization 648SP1 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Data VirtualizationRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, whic ...
Synopsis Important: Red Hat AMQ Streams 167 release and security update Type/Severity Security Advisory: Important Topic Red Hat AMQ Streams 167 is now available from the Red Hat Customer PortalRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, ...
Synopsis Important: Red Hat Data Grid 739 security update Type/Severity Security Advisory: Important Topic An update for Red Hat Data Grid is now availableRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, ...
Synopsis Important: parfait:05 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the parfait:05 module is now available for Red Hat Enterprise Linux 81 Update Services for SAP SolutionsRed ...
Synopsis Important: rh-maven36-log4j12 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for rh-maven36-log4j12 is now available for Red Hat Software CollectionsRed Hat Product Security has rated ...
Synopsis Moderate: Red Hat Single Sign-On 751 security update Type/Severity Security Advisory: Moderate Topic A security update is now available for Red Hat Single Sign-On 75 from the Customer PortalRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base sco ...
Synopsis Important: Red Hat JBoss Fuse/A-MQ 63 R20 security and bug fix update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Fuse 63 and Red Hat JBoss A-MQ 63Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) ...
Synopsis Important: Red Hat JBoss Enterprise Application Platform 74 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic A security update is now available for Red Hat JBoss Enterprise Application Platform 7 ...
Synopsis Important: Red Hat JBoss Enterprise Application Platform 74 security update Type/Severity Security Advisory: Important Topic A security update is now available for Red Hat JBoss Enterprise Application Platform 74Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring ...
Synopsis Moderate: Red Hat Single Sign-On 751 for OpenShift image security and enhancement update Type/Severity Security Advisory: Moderate Topic A new image is available for Red Hat Single Sign-On 751, running on OpenShift Container Platform 310 and 311, and 49Red Hat Product Security has rated this update as having a security impact ...
Synopsis Important: Red Hat Single Sign-On 751 security update on RHEL 8 Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic New Red Hat Single Sign-On 751 packages are now available for Red Hat Enterprise Linux 8Red Hat ...
Synopsis Important: Red Hat JBoss Enterprise Application Platform 64 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 64Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System ( ...
Synopsis Important: Red Hat Single Sign-On 751 security update on RHEL 7 Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic New Red Hat Single Sign-On 751 packages are now available for Red Hat Enterprise Linux 7Red Hat ...
Synopsis Low: RHV Manager (ovirt-engine) security update [ovirt-4410-1] Type/Severity Security Advisory: Low Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Updated ovirt-engine packages that fix several bugs and add various enhancements are now availableRed Ha ...
Synopsis Important: parfait:05 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the parfait:05 module is now available for Red Hat Enterprise Linux 84 Extended Update SupportRed Hat Produc ...
Synopsis Important: parfait:05 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the parfait:05 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this ...
Synopsis Important: Red Hat JBoss Data Virtualization 648SP2 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Data VirtualizationRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, whic ...
Synopsis Important: Red Hat JBoss Enterprise Application Platform 6424 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic A security update is now available for Red Hat JBoss Enterprise Application Platform ...
Synopsis Important: Red Hat AMQ Streams 201 release and security update Type/Severity Security Advisory: Important Topic Red Hat AMQ Streams 201 is now available from the Red Hat Customer PortalRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, ...
Synopsis Important: Red Hat JBoss Enterprise Application Platform 64 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update is now available for Red Hat JBoss Enterprise Application Platform 64 for Re ...
Synopsis Moderate: Red Hat Fuse 7101 release and security update Type/Severity Security Advisory: Moderate Topic A minor version update (from 710 to 7101) is now available for Red Hat Fuse The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Product Security has rated this update ...
Synopsis Important: Red Hat JBoss Enterprise Application Platform 6424 security update Type/Severity Security Advisory: Important Topic A security update is now available for Red Hat JBoss Enterprise Application Platform 64 Red Hat Product Security has rated this update as having a security impact of ImportantA Common Vulnerability Scori ...
Synopsis Important: Red Hat JBoss Enterprise Application Platform 6424 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic A security update is now available for Red Hat JBoss Enterprise Application Platform ...
Synopsis Moderate: Red Hat Single Sign-On 7410 on OpenJDK for OpenShift image security update Type/Severity Security Advisory: Moderate Topic A new image is available for Red Hat Single Sign-On 7410 on OpenJDK, running on OpenShift Container Platform 310 and 311, and 43Red Hat Product Security has rated this update as having a securit ...
Synopsis Moderate: Red Hat Single Sign-On 7410 on OpenJ9 for OpenShift image security update Type/Severity Security Advisory: Moderate Topic A new image is available for Red Hat Single Sign-On 7410 on OpenJ9, running on OpenShift Container Platform 310 and 311, and 43Red Hat Product Security has rated this update as having a security ...
Synopsis Low: Red Hat JBoss Enterprise Application Platform 744 security update Type/Severity Security Advisory: Low Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic A security update is now available for Red Hat JBoss Enterprise Application Platform 74 for Red ...
Synopsis Low: Red Hat JBoss Enterprise Application Platform 744 security update Type/Severity Security Advisory: Low Topic A security update is now available for Red Hat JBoss Enterprise Application Platform 74Red Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVSS) ba ...
Synopsis Low: Red Hat JBoss Enterprise Application Platform 744 security update Type/Severity Security Advisory: Low Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic A security update is now available for Red Hat JBoss Enterprise Application Platform 74 for Red ...

Recent Articles

Triton malware still a threat to energy sector, FBI warns
The Register • Jessica Lyons Hardcastle • 01 Jan 1970

Get our weekly newsletter Plus: Ransomware gangster sentenced, Dell patches more Log4j bugs, and cartoon apes gone bad

In Brief Triton malware remains a threat to the global energy sector, according to an FBI warning. Triton is the software nasty used in a 2017 cyber attack carried out by a Russian government-backed research institution against a Middle East petrochemical facility. The new FBI warning [PDF] came a day after the US Department of Justice unsealed a pair of indictments that detail alleged Russian government efforts to use supply chain attacks and malware in an attempt to compromise and control crit...