Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2021-44228] Log4j: Is My Organization Impacted?

netspi.com | vulnerability | CVE-2021-44228 | #rce | #java | #log4j | #mitigation | #log4shell | #cve-2021-44228

Summary

Find out if your organization is vulnerable to the Log4j vulnerabilities, read about the impact of CVE-2021-44228 and its variants, and learn mitigation steps to take.
CVE
CVE-2021-44228
Published
Collected

original ↗

Related coverage

vulnerability · blog.viettelcybersecurity.com
CVE-2021-44228 | Lỗ hổng NGHIÊM TRỌNG trên thư viện Apache Log4j và các vấn đề liên quan
An overview of Log4Shell (CVE-2021-44228): unauthenticated JNDI injection RCE in Log4j 2.0-beta9 through 2.14.1, rated CVSS 10, noting JNDI injection research dates back to Black Hat 2016.
vulnerability · bishopfox.com
How Bishop Fox Has Been Identifying and Exploiting Log4shell
Bishop Fox's account of the first chaotic week of Log4shell (CVE-2021-44228): JNDI/LDAP payloads sprayed via HTTP headers and DNS exfiltration when outbound TCP was blocked.
vulnerability · bugcrowd.com
Log4Shell, The Worst Java Vulnerability in Years
Log4Shell (CVE-2021-44228) is a 10.0-critical RCE affecting Apache Log4j 2.0-beta9 to 2.14.1, hitting Apple, Cloudflare, Twitter, and Minecraft—considered worse than the 2017 Apache Struts flaw.
research · blog.viettelcybersecurity.com
The Log4Shell vulnerability may have been exploited since August 2021
Analyzing DNS logger logs, Viettel researchers conclude Log4Shell exploitation may have begun around September 4, 2021 - months before disclosure - hitting at least 10 organizations worldwide.
vulnerability · bishopfox.com
Log4j Vulnerability: Impact Analysis
Bishop Fox experts analyze CVE-2021-44228's impact: CVSS 10 unauthenticated RCE in Apache Log4j, first mass scanning on December 10, 2021, and affected projects from Elasticsearch to Struts.
vulnerability · hackerone.com
Log4j Vulnerability Activity on the HackerOne Platform
HackerOne's coverage of Log4Shell: the incomplete 2.15.0 patch led to CVE-2021-45046, upgraded to critical (CVSS 9.0), with advice to upgrade to Log4j 2.16.0 and add Log4j bugs to bounty scope.
back