CVE-2021-42550

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

• CWE-502
• CWE-502

• http://logback.qos.ch/news.htmlVendor Advisory
• http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/Jul/11Mailing List, Third Party Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdfThird Party Advisory
• https://github.com/cn-panda/logbackRceDemoExploit, Third Party Advisory
• https://jira.qos.ch/browse/LOGBACK-1591Exploit, Issue Tracking, Patch, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20211229-0001/Third Party Advisory
• http://logback.qos.ch/news.htmlVendor Advisory
• http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/Jul/11Mailing List, Third Party Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdfThird Party Advisory
• https://github.com/cn-panda/logbackRceDemoExploit, Third Party Advisory
• https://jira.qos.ch/browse/LOGBACK-1591Exploit, Issue Tracking, Patch, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20211229-0001/Third Party Advisory

Published

Dec 16, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42545An insufficient session expiration vulnerability exists in B…9.1
• CVE-2021-42546Insufficient Input Validation in the search functionality of…6.1
• CVE-2021-42547Insufficient Input Validation in the search functionality of…6.1
• CVE-2021-42548Insufficient Input Validation in the search functionality of…6.1
• CVE-2021-42549Insufficient Input Validation in the search functionality of…6.1
• CVE-2021-4255A vulnerability was found in ctrlo lenio and classified as p…6.1
• CVE-2021-42551Cross-site Scripting (XSS) vulnerability in the search funct…6.1
• CVE-2021-42552Cross-site Scripting (XSS) vulnerability in ArchivistaBox we…6.1
• CVE-2021-42553A buffer overflow vulnerability in stm32_mw_usb_host of STMi…9.8
• CVE-2021-42554An issue was discovered in Insyde InsydeH2O with Kernel 5.0 …8.2
• CVE-2021-42555Pexip Infinity before 26.2 allows temporary remote Denial of…7.5
• CVE-2021-42556Rasa X before 0.42.4 allows Directory Traversal during archi…5.5