Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2021-4104 Details

Description

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CNA: CISA-ADPCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://access.redhat.com/security/cve/CVE-2021-4104	CVE
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126	CVE
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033	CVE
https://security.gentoo.org/glsa/202209-02	CVE
https://security.gentoo.org/glsa/202310-16	CVE
https://security.gentoo.org/glsa/202312-02	CVE
https://security.gentoo.org/glsa/202312-04	CVE
https://security.netapp.com/advisory/ntap-20211223-0007/	CVE
https://www.cve.org/CVERecord?id=CVE-2021-44228	CVE
https://www.kb.cert.org/vuls/id/930724	CVE
https://www.oracle.com/security-alerts/cpuapr2022.html	CVE
https://www.oracle.com/security-alerts/cpujan2022.html	CVE
https://www.oracle.com/security-alerts/cpujul2022.html	CVE
http://www.openwall.com/lists/oss-security/2022/01/18/3	CVE
https://access.redhat.com/security/cve/CVE-2021-4104	[email protected]
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126	[email protected]
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033	[email protected]
https://security.gentoo.org/glsa/202209-02	[email protected]
https://security.gentoo.org/glsa/202310-16	[email protected]
https://security.gentoo.org/glsa/202312-02	[email protected]
https://security.gentoo.org/glsa/202312-04	[email protected]
https://security.netapp.com/advisory/ntap-20211223-0007/	[email protected]
https://www.cve.org/CVERecord?id=CVE-2021-44228	[email protected]
https://www.kb.cert.org/vuls/id/930724	[email protected]
https://www.oracle.com/security-alerts/cpuapr2022.html	[email protected]
https://www.oracle.com/security-alerts/cpujan2022.html	[email protected]
https://www.oracle.com/security-alerts/cpujul2022.html	[email protected]
http://www.openwall.com/lists/oss-security/2022/01/18/3	[email protected]

see all 28 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-502	Deserialization of Untrusted Data	[email protected]
CWE-502	Deserialization of Untrusted Data	[email protected]

Affected Products

Product	Versions
apache log4j	1.2
CPE cpe:2.3:a:apache:log4j:1.2:::::::* Remediation No remediation found in references.
fedoraproject fedora	35
CPE cpe:2.3:o:fedoraproject:fedora:35:::::::* Remediation No remediation found in references.
redhat codeready studio	12.0
CPE cpe:2.3:a:redhat:codeready_studio:12.0:::::::* Remediation No remediation found in references.
redhat integration camel k	All versions
CPE cpe:2.3:a:redhat:integration_camel_k:-:::::::* Remediation No remediation found in references.
redhat integration camel quarkus	All versions
CPE cpe:2.3:a:redhat:integration_camel_quarkus:-:::::::* Remediation No remediation found in references.
redhat jboss a-mq	6.0.0 7
CPE cpe:2.3:a:redhat:jboss_a-mq:6.0.0:::::::* cpe:2.3:a:redhat:jboss_a-mq:7:::::::* Remediation No remediation found in references.
redhat jboss a-mq streaming	All versions
CPE cpe:2.3:a:redhat:jboss_a-mq_streaming:-:::::::* Remediation No remediation found in references.
redhat jboss data grid	7.0.0
CPE cpe:2.3:a:redhat:jboss_data_grid:7.0.0:::::::* Remediation No remediation found in references.
redhat jboss data virtualization	6.0.0
CPE cpe:2.3:a:redhat:jboss_data_virtualization:6.0.0:::::::* Remediation No remediation found in references.
redhat jboss enterprise application platform	6.0.0 7.0
CPE cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:::::::* cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:::::::* Remediation No remediation found in references.
redhat jboss fuse	6.0.0 7.0.0
CPE cpe:2.3:a:redhat:jboss_fuse:6.0.0:::::::* cpe:2.3:a:redhat:jboss_fuse:7.0.0:::::::* Remediation No remediation found in references.
redhat jboss fuse service works	6.0
CPE cpe:2.3:a:redhat:jboss_fuse_service_works:6.0:::::::* Remediation No remediation found in references.
redhat jboss operations network	3.0
CPE cpe:2.3:a:redhat:jboss_operations_network:3.0:::::::* Remediation No remediation found in references.
redhat jboss web server	3.0
CPE cpe:2.3:a:redhat:jboss_web_server:3.0:::::::* Remediation No remediation found in references.
redhat openshift application runtimes	All versions
CPE cpe:2.3:a:redhat:openshift_application_runtimes:-:::::::* Remediation No remediation found in references.
redhat openshift container platform	4.6 4.7 4.8
CPE cpe:2.3:a:redhat:openshift_container_platform:4.6:::::::* cpe:2.3:a:redhat:openshift_container_platform:4.7:::::::* cpe:2.3:a:redhat:openshift_container_platform:4.8:::::::* Remediation No remediation found in references.
redhat process automation	7.0
CPE cpe:2.3:a:redhat:process_automation:7.0:::::::* Remediation No remediation found in references.
redhat single sign-on	7.0
CPE cpe:2.3:a:redhat:single_sign-on:7.0:::::::* Remediation No remediation found in references.
redhat software collections	All versions
CPE cpe:2.3:a:redhat:software_collections:-:::::::* Remediation No remediation found in references.
redhat enterprise linux	6.0 7.0 8.0
CPE cpe:2.3:o:redhat:enterprise_linux:6.0:::::::* cpe:2.3:o:redhat:enterprise_linux:7.0:::::::* cpe:2.3:o:redhat:enterprise_linux:8.0:::::::* Remediation No remediation found in references.
oracle advanced supply chain planning	12.1 12.2
CPE cpe:2.3:a:oracle:advanced_supply_chain_planning:12.1:::::::* cpe:2.3:a:oracle:advanced_supply_chain_planning:12.2:::::::* Remediation No remediation found in references.
oracle business intelligence	5.9.0.0.0 12.2.1.3.0 12.2.1.4.0
CPE cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0::::enterprise::: cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0::::enterprise::: cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0::::enterprise::: Remediation No remediation found in references.
oracle business process management suite	12.2.1.3.0 12.2.1.4.0
CPE cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:::::::* cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:::::::* Remediation No remediation found in references.
oracle communications eagle ftp table base retrieval	4.5
CPE cpe:2.3:a:oracle:communications_eagle_ftp_table_base_retrieval:4.5:::::::* Remediation No remediation found in references.
oracle communications messaging server	8.1
CPE cpe:2.3:a:oracle:communications_messaging_server:8.1:::::::* Remediation No remediation found in references.
oracle communications network integrity	7.3.6
CPE cpe:2.3:a:oracle:communications_network_integrity:7.3.6:::::::* Remediation No remediation found in references.
oracle communications offline mediation controller	< 12.0.0.4.0 12.0.0.5.0
CPE cpe:2.3:a:oracle:communications_offline_mediation_controller:::::::: cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.5.0:::::::* Remediation No remediation found in references.
oracle communications unified inventory management	7.3.4 7.3.5 7.4.1 7.4.2
CPE cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:::::::* cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:::::::* cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:::::::* cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:::::::* Remediation No remediation found in references.
oracle e-business suite cloud manager and cloud backup module	2.2.1.1.1
CPE cpe:2.3:a:oracle:e-business_suite_cloud_manager_and_cloud_backup_module:2.2.1.1.1:::::::* Remediation No remediation found in references.
oracle enterprise manager base platform	13.4.0.0 13.5.0.0
CPE cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:::::::* cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:::::::* Remediation No remediation found in references.
oracle financial services revenue management and billing analytics	2.7.0.0 2.7.0.1 2.8.0.0
CPE cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7.0.0:::::::* cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7.0.1:::::::* cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8.0.0:::::::* Remediation No remediation found in references.
oracle fusion middleware common libraries and tools	12.2.1.4.0
CPE cpe:2.3:a:oracle:fusion_middleware_common_libraries_and_tools:12.2.1.4.0:::::::* Remediation No remediation found in references.
oracle goldengate	All versions
CPE cpe:2.3:a:oracle:goldengate:-:::::::* Remediation No remediation found in references.
oracle healthcare data repository	8.1.0
CPE cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:::::::* Remediation No remediation found in references.
oracle hyperion data relationship management	< 11.2.8.0
CPE cpe:2.3:a:oracle:hyperion_data_relationship_management:::::::: Remediation No remediation found in references.
oracle hyperion infrastructure technology	< 11.2.8.0
CPE cpe:2.3:a:oracle:hyperion_infrastructure_technology:::::::: Remediation No remediation found in references.
oracle identity management suite	12.2.1.3.0 12.2.1.4.0
CPE cpe:2.3:a:oracle:identity_management_suite:12.2.1.3.0:::::::* cpe:2.3:a:oracle:identity_management_suite:12.2.1.4.0:::::::* Remediation No remediation found in references.
oracle jdeveloper	12.2.1.3.0
CPE cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:::::::* Remediation No remediation found in references.
oracle mysql enterprise monitor	<= 8.0.29
CPE cpe:2.3:a:oracle:mysql_enterprise_monitor:::::::: Remediation No remediation found in references.
oracle retail allocation	14.1.3.2 15.0.3.1 16.0.3 19.0.1
CPE cpe:2.3:a:oracle:retail_allocation:14.1.3.2:::::::* cpe:2.3:a:oracle:retail_allocation:15.0.3.1:::::::* cpe:2.3:a:oracle:retail_allocation:16.0.3:::::::* cpe:2.3:a:oracle:retail_allocation:19.0.1:::::::* Remediation No remediation found in references.
oracle retail extract transform and load	13.2.5
CPE cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.5:::::::* Remediation No remediation found in references.
oracle stream analytics	All versions
CPE cpe:2.3:a:oracle:stream_analytics:-:::::::* Remediation No remediation found in references.
oracle timesten grid	All versions
CPE cpe:2.3:a:oracle:timesten_grid:-:::::::* Remediation No remediation found in references.
oracle tuxedo	12.2.2.0.0
CPE cpe:2.3:a:oracle:tuxedo:12.2.2.0.0:::::::* Remediation No remediation found in references.
oracle utilities testing accelerator	6.0.0.1.1 6.0.0.2.2 6.0.0.3.1
CPE cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:::::::* cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:::::::* cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:::::::* Remediation No remediation found in references.
oracle weblogic server	12.2.1.3.0 12.2.1.4.0 14.1.1.0.0
CPE cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:::::::* cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:::::::* cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:::::::* Remediation No remediation found in references.

Change History

22 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
May 28, 2026	CVE Modified	CISA-ADP
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Dec 22, 2023	CVE Modified	[email protected]
Dec 20, 2023	CVE Modified	[email protected]
Nov 7, 2023	CVE Source Update	[email protected]
Nov 7, 2023	CVE Modified	[email protected]
Oct 26, 2023	CVE Modified	[email protected]
Oct 5, 2022	Modified Analysis	[email protected]
Sep 7, 2022	CVE Modified	[email protected]
Jul 25, 2022	CVE Modified	[email protected]
Apr 20, 2022	CVE Modified	[email protected]
Feb 19, 2022	Modified Analysis	[email protected]
Feb 7, 2022	CVE Modified	[email protected]
Jan 18, 2022	CVE Modified	[email protected]
Jan 6, 2022	Modified Analysis	[email protected]
Dec 23, 2021	CVE Modified	[email protected]
Dec 21, 2021	CVE Modified	[email protected]
Dec 16, 2021	Initial Analysis	[email protected]
Dec 16, 2021	CVE Modified	[email protected]

CVE-2021-4104 Details

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation