Strix
26.1K

CVE-2021-45046

CRITICALCVSS 9/10Actively ExploitedEPSS 99.98%

Last modified

CVE-2021-45046 is a critical-severity vulnerability rated 9/10 on the CVSS scale. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. CISA has confirmed active exploitation in the wild. EPSS estimates a 99.98% chance of exploitation in the next 30 days.

Description

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

Metrics

CVSS 3.1
9/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Probability
99.98%

100.0th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .

Weakness Enumeration

Affected Software

VendorProductVersions
ApacheLog4j>= 2.0.1, < 2.12.2
ApacheLog4j>= 2.13.0, < 2.16.0
ApacheLog4j2.0
CvatComputer Vision Annotation ToolAll versions
IntelAudio Development KitAll versions
IntelDatacenter ManagerAll versions
IntelGenomics Kernel LibraryAll versions
IntelOneapiAll versions
IntelSecure Device OnboardAll versions
IntelSensor Solution Firmware Development KitAll versions
IntelSystem DebuggerAll versions
IntelSystem StudioAll versions
SiemensSppa-T3000 Ses3000 FirmwareAll versions
SiemensCaptial< 2019.1
SiemensCaptial2019.1
SiemensComosAll versions
SiemensDesigo Cc Advanced Reports4.0
SiemensDesigo Cc Advanced Reports4.1
SiemensDesigo Cc Advanced Reports4.2
SiemensDesigo Cc Advanced Reports5.0
SiemensDesigo Cc Advanced Reports5.1
SiemensDesigo Cc Info Center5.0
SiemensDesigo Cc Info Center5.1
SiemensE-Car Operation Center< 2021-12-13
SiemensEnergy Engage3.1
SiemensEnergyip8.5
SiemensEnergyip8.6
SiemensEnergyip8.7
SiemensEnergyip9.0
SiemensEnergyip Prepay3.7
SiemensEnergyip Prepay3.8
SiemensGma-Manager< 8.6.2j-398
SiemensHead-End System Universal Device Integration SystemAll versions
SiemensIndustrial Edge ManagementAll versions
SiemensIndustrial Edge Management Hub< 2021-12-13
SiemensLogo\! Soft ComfortAll versions
SiemensMendixAll versions
SiemensMindsphere< 2021-12-11
SiemensNavigator< 2021-12-13
SiemensNxAll versions
SiemensOpcenter Intelligence<= 3.2
SiemensOperation Scheduler<= 1.1.3
SiemensSentron Powermanager4.1
SiemensSentron Powermanager4.2
SiemensSiguard Dsa4.2
SiemensSiguard Dsa4.3
SiemensSiguard Dsa4.4
SiemensSipass Integrated2.80
SiemensSipass Integrated2.85
SiemensSiveillance Command<= 4.16.2.1

Showing 50 of 78 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2021-45046?
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
How severe is CVE-2021-45046?
CVE-2021-45046 has a CVSS score of 9/10 (CRITICAL severity). The EPSS model estimates a 99.98% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
How do I fix CVE-2021-45046?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-45046?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST