CVE-2021-45046

Summary

CVE-2021-45046 is a new vulnerability affecting Apache Log4j version 2.15.0. This issue arises from an incomplete fix implemented for CVE-2021-44228. In specific non-default configurations where the logging pattern uses Context Lookup or Thread Context Map, attackers can exploit this vulnerability by crafting malicious JNDI Lookup input data. Consequences include information leaks and remote code execution in some environments, as well as local code execution in all environments. The latest versions, Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7), address this issue by eliminating message lookup patterns and disabling JNDI functionality by default.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.