CVE-2021-44228

Description from NVD

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Attack Vector (AV)	Network	Adjacent	Local	Physical
Attack Complexity (AC)	LOW	High
Privileges Required (PR)	None	Low	High
User Interaction (UI)	None	Required
Scope (S)	Unchanged	Changed
Confidentiality (C)	None	Low	High
Integrity (I)	None	Low	High
Availability (A)	None	Low	High

CVE Infomation	Exploits or more Infomation
mitre	EXPLOIT DATABASE
NVD	0day.today
vulmon.com	github
CVE Details	Twitter
JVN ENG JPN
Reconshell

URL	Num of Times Referred to
http://vulmon.com/vulnerabilitydetails?qid=CVE-2021	580
https://alerts.vulmon.com/?utm_source=twitter&utm_medium=so...	225
https://cvetrends.com	51
http://cyberiqs.com/latestnews	44
https://www.reddit.com/r/blueteamsec/comments/rd38z9/log4j_...	39
http://twinybots.ch	25
https://lists.astaro.com/ASGV9-IPS-rules.html#0	19
https://cybersec.continuitysoftware.com/s/centralized-list-...	18
https://us-cert.cisa.gov/ncas/current-activity/2021/12/13/c...	17
https://thehackernews.com/2021/12/extremely-critical-log4j-...	16
https://b.hatena.ne.jp/entry/s/discuss.elastic.co/t/apache-...	13
https://www.truesec.com/hub/blog/apache-log4j-injection-vul...	10
https://cybersec.cycognito.com/s/apache-log4j-vulnerability...	10
https://www.jenkins.io/blog/2021/12/10/log4j2-rce-CVE-2021-...	8
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tlto...	8
https://access.redhat.com/security/cve/cve-2021-44228	8
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2...	8
https://www.searchenginejournal.com/log4j-security-fail/429...	8
https://ift.tt/3rTZmsv	7
https://checkmarx.com/blog/apache-log4j-remote-code-executi...	7
https://blogs.juniper.net/en-us/enterprise-cloud-and-transf...	7
https://networks.unify.com/security/advisories/OBSO-2201-01...	7
http://t.me/gobies	6
https://zero.bs/sb-2121-log4j-rce-cve-2021-44228.html	6
http://Tenable.sc	6
https://www.akamai.com/blog/news/CVE-2021-44228-Zero-Day-Vu...	6
https://www.mcafee.com/enterprise/en-us/lp/insights-preview...	6
https://kb.paessler.com/en/topic/90213-is-prtg-affected-by-...	6
https://cloud.google.com/blog/products/identity-security/cl...	6
https://www.huntress.com/blog/rapid-response-critical-rce-v...	6
https://www.creeperhost.net/wiki/books/minecraft-java-editi...	6
https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-...	6
https://GlobalSecurityDatabase.org	6
https://research.kudelskisecurity.com/2021/12/10/log4shell-...	6
https://qiita.com/ohtsuka1317/items/54f47a732e24e97237c5	5
http://slf4j.org/log4shell.html	5
https://opsmtrs.com/3yDxEBf	5
https://cyberwatch.fr/cve/cve-2021-44228-log4shell-comment-...	5
https://www.intel.com/content/www/us/en/security-center/adv...	5
https://www.snort.org/downloads	5
https://databricks.com/blog/2021/12/13/log4j2-vulnerability...	5
http://logback.qos.ch/news.html	5
https://www.elastic.co/blog/detecting-log4j2-with-elastic-s...	5
https://www.nisc.go.jp/press/pdf/20211213NISC_press.pdf	5
https://forum.xwiki.org/t/log4j-cve-2021-44228-log4shell-ze...	5
https://www.imperva.com/blog/how-were-protecting-customers-...	5
https://tweetedtimes.com/v/21183?s=tnp	5
https://www.secuavail.com/kb/nw-device/utm-waf-and-cve-2021...	5
https://www.auscert.org.au/bulletins/ESB-2021.4302	5
https://www.cyberkendra.com/2021/12/worst-log4j-rce-zeroday...	5
https://scan.netsecurity.ne.jp/article/2021/12/14/46812.html	5
https://blog.talosintelligence.com/2021/12/apache-log4j-rce...	5
https://security.stackexchange.com/questions/257873/does-cv...	5
https://j.mp/3taaXUN	4
https://redis.com/security/notice-apache-log4j2-cve-2021-44...	4
https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-...	4
https://yamory.io/blog/useful-functions-for-log4j-vulnerabi...	4
https://prtimes.jp/main/html/rd/p/000000018.000073493.html	4
https://puppet.com/blog/puppet-response-to-remote-code-exec...	4
https://github.blog/2021-12-13-githubs-response-to-log4j-vu...	4
https://level69.net/archives/28320	4
https://mackerel.io/ja/blog/entry/announcement/20211214	4
https://www.ibm.com/blogs/psirt/an-update-on-the-apache-log...	4
https://deepfence.io/cve-2021-44228-log4j2-exploitability-a...	4
https://www.cisa.gov/uscert/ncas/current-activity/2021/12/1...	4
https://www.esri.com/arcgis-blog/products/arcgis-enterprise...	4
https://ivanti.social/8mjw6a	4
https://www.npa.go.jp/cyberpolice/important/2021/202112141....	4
https://www.zdnet.com/article/security-warning-new-zero-day...	4
https://4securitas.com/log4j-vulnerability-on-4securitas-so...	4
https://aws.amazon.com/security/security-bulletins/AWS-2021...	4
https://pandorafms.com/blog/cve-2021-44228/	4
https://www.rapid7.com/blog/post/2021/12/15/the-everyperson...	4
https://www.rumble.run/blog/finding-log4j/	4
https://therecord.media/log4j-zero-day-gets-security-fix-ju...	4
https://tools.cisco.com/security/center/content/CiscoSecuri...	4
https://www.access42.nl/nieuws/cve-2021-44228-proof-of-conc...	4
https://www.blumira.com/cve-2021-44228-log4shell/	4
https://www.cnblogs.com/nice0e3/p/14531327.html	4
https://www.mongodb.com/blog/post/log4shell-vulnerability-c...	4
https://www.randori.com/blog/cve-2021-44228/	4
https://about.gitlab.com/blog/2021/12/15/updates-and-action...	4
https://community.ui.com/releases/UniFi-Network-Application...	4
https://hub.crowdsec.net/author/crowdsecurity/configuration...	4
https://tdm.socprime.com/quick-hunt/	4
https://www.jpcert.or.jp/at/2021/at210050.html	4
https://blog.sonatype.com/why-did-log4shell-set-the-interne...	4
https://forums.cpanel.net/threads/log4j-cve-2021-44228-does...	4
https://hardenedvault.net/2021/12/17/analysis-CVE-2021-4422...	4
https://security.sios.com/vulnerability/misc-security-vulne...	4
https://blogs.jpcert.or.jp/ja/2021/12/log4j-cve-2021-44228....	4
https://support.arduino.cc/hc/en-us/articles/4412377144338-...	4
https://support.claris.com/s/answerview?language=ja&anum=00...	4
https://blog.cloudflare.com/cve-2021-44228-log4j-rce-0-day-...	4
https://blogs.quickheal.com/critical-zero-day-log4shell-vul...	4
https://hominido.medium.com/iocs-para-log4shell-rce-0-day-c...	4
https://infosecwriteups.com/log4shell-simplified-all-you-ne...	4
http://feeds.feedburner.com/~ff/linuxquestions/latest?d=yIl...	4
https://news.ycombinator.com/item?id=29526905	4
https://corp.moneyforward.com/news/info/20211214-mf-press-2/	4
https://blog.serverworks.co.jp/aws-announcement-about-log4j...	4
https://www.securityartwork.es/2021/12/13/log4shell-apache-...	4
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf	4
https://minecraft.mixjuice.info/2021/12/10/cve-2021-44228/	4
https://research.trendmicro.com/3INubVV	4
https://www.helpnetsecurity.com/2021/12/10/cve-2021-44228/	4
https://milestone-of-se.nesuke.com/sv-advanced/sv-security/...	4
https://unit42.paloaltonetworks.jp/apache-log4j-vulnerabili...	4
http://cs.co/6013Jtb8H	3
https://bit.ly/3DPoWkJ	3
https://dev.to/sebiboga/jmeter-541-fix-for-security-cve-202...	3
https://buff.ly/31Pc8Ok	3
https://cybr.ly/31F2cXL	3
https://msft.it/6015ZJbYt	3
https://a-zs.net/apache_log4j_vulnerability/	3
http://cisa.gov	3
https://hclsw.co/hoge7x	3
https://youtu.be/7qoPDq41xhQ	3
https://anchor.fm/dokanai/episodes/vs-CVE-2021-44228-Log4Sh...	3
http://earmas.ga	3
https://tchnk.com/u6lJuE	3
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q	3
https://sysdig.com/blog/cve-critical-vulnerability-log4j/	3
https://ubuntu.com/security/CVE-2021-44228	3
https://fullhunt.io/blog/2021/12/13/detecting-log4j-rce-at-...	3
https://kloudle.com/blog/log4j-cve-2021-44228-rce-how-to-pr...	3
https://tolisec.com/iot-botnet-exploiting-log4j-cve-2021-44228	3
https://twitter.com/P0rZ9/status/1468949890571337731	3
https://umbraco.com/blog/security-advisory-december-15-2021...	3
https://www.cve.org/CVERecord?id=CVE-2021-44228	3
https://blog.kie.org/2021/12/kie-log4j2-exploit-cve-2021-44...	3
https://crowdsec.net/log4j-tracker	3
https://csirt.gov.it/contenuti/vulnerabilita-log4shell-cve-...	3
https://gigazine.net/news/20211213-cve-2021-44228-jndi-lookup/	3
https://isc.sans.edu/forums/diary/28130	3
https://prophaze.com/cve/apache-log4j-up-to-2-14-1-jndi-lda...	3
https://scalingo.com/fr/blog/cve-2021-44228-log4shell	3
https://sec.okta.com/articles/2021/12/log4shell	3
https://socprime.com/blog/cve-2021-44228-detection-notoriou...	3
https://sylarsec.com/2021/12/24/understanding-log4j-and-log...	3
https://www.heise.de/news/Kritische-Zero-Day-Luecke-in-log4...	3
https://www.suse.com/c/suse-statement-on-log4j-log4shell-cv...	3
https://blogs.sap.com/2021/12/14/hana-xsa-log4j-cve-2021-44...	3
https://fusionauth.io/blog/2021/12/10/log4j-fusionauth/	3
https://guardedbox.es	3
https://kb.vmware.com/s/article/87068	3
https://kc.mcafee.com/corporate/index?page=content&id=KB95091	3
https://logrhythm.com/blog/cve-2021-44228-log4shell-detection	3
https://microsoft.com/security/blog/2021/12/11/guidance-for...	3
https://smartbear.com/security/cve-2021-44228/	3
https://tryhackme.com/room/solar	3
https://uberagent.com/blog/log4shell-cve-2021-44228-splunk-...	3
https://www.ipa.go.jp/security/ciadr/vul/alert20211213.html	3
https://www.lac.co.jp/lacwatch/alert/20211213_002820.html	3
https://www.nginx.com/blog/mitigating-the-log4j-vulnerabili...	3
https://www.scutum.jp/information/waf_tech_blog/2021/12/waf...	3
https://at-virtual.net/%e3%82%bb%e3%82%ad%e3%83%a5%e3%83%aa...	3
https://attackerkb.com/topics/in9sPR2Bzt/cve-2021-44228-log...	3
http://cti.uncoder.io	3
https://go.trellix.com/3Lgz9Mb	3
https://kb.tableau.com/articles/issue/Apache-Log4j2-vulnera...	3
https://opensearch.org/blog/releases/2021/12/update-to-1-2-1/	3
https://reconshell.com/apache-log4j2-vulnerability-patch/	3
https://securelist.com/cve-2021-44228-vulnerability-in-apac...	3
https://support.f5.com/csp/article/K19026212	3
https://threatpost.com/log4shell-bug-smbs-experts/177021/	3
https://www.cadenas.de/news-reader/items/jp-20211216-Apache...	3
https://www.citrix.com/blogs/2021/12/13/guidance-for-reduci...	3
https://www.docker.com/blog/apache-log4j-2-cve-2021-44228/	3
https://www.fastly.com/blog/digging-deeper-into-log4shell-0...	3
https://www.lunasec.io/docs/blog/log4j-zero-day/	3
https://www.oracle.com/security-alerts/alert-cve-2021-44228...	3
https://www.splunk.com/en_us/blog/bulletins/splunk-security...	3
https://www.vmware.com/security/advisories/VMSA-2021-0028.html	3
https://arstechnica.com/information-technology/2021/12/mine...	3
https://blog.fox-it.com/2021/12/14/log4j-jndi-be-gone-a-sim...	3
https://blog.ipfire.org/post/no-java-no-cry-ipfire-is-not-v...	3
https://blog.qualys.com/vulnerabilities-threat-research/202...	3
https://core.vmware.com/vmsa-2021-0028-questions-answers-faq	3
https://coreruleset.org/20211213/crs-and-log4j-log4shell-cv...	3
https://docs.docker.com/desktop/mac/release-notes/#docker-d...	3
https://gist.github.com/gnremy/c546c7911d5f876f263309d7161a...	3
https://help.live2d.com/cubismeditor/log4j-cve-2021-44228	3
https://support.sap.com/content/dam/support/en_us/library/s...	3
https://think.unblog.ch/zero-day-log4j-luecke-pruefen-cve-2...	3
https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnunge...	3
https://www.maltego.com/blog/our-response-to-log4j-cve-2021...	3
https://www.ncsc.gov.uk/news/apache-log4j-vulnerability	3
https://www.tableau.com/about/blog/2021/12/update-apache-lo...	3
https://www.tenable.com/blog/cve-2021-44228-proof-of-concep...	3
https://www.youtube.com/watch?v=7qoPDq41xhQ	3
http://Scanmycode.today	3
https://blog.pythian.com/cve-2021-44228-and-your-oracle-e-b...	3
https://blogs.apache.org/security/entry/cve-2021-44228	3
https://blogs.oracle.com/security/post/cve-2021-44228	3
https://blogs.vmware.com/security/2021/12/investigating-cve...	3
https://flink.apache.org/2021/12/10/log4j-cve.html	3
https://wiki.eclipse.org/Eclipse_and_log4j2_vulnerability_(...	3
https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A...	3
https://www.boxsquare.jp/blog/log4j-vulnerability	3
https://www.greynoise.io/blog/apache-log4j-vulnerability-CV...	3
http://www.kitploit.com/2021/12/log4j-detector-detects-log4...	3
https://www.linkedin.com/pulse/log4j-vulnerability-cve-2021...	3
https://www.mandiant.com/resources/mobileiron-log4shell-exp...	3
https://www.openwall.com/lists/oss-security/2021/12/14/4	3
https://www.softek.co.jp/SID/blog/archive/entry/20211215.html	3
https://www.traceable.ai/blog-post/traceable-ai-can-help-de...	3
https://www.veracode.com/blog/security-news/urgent-analysis...	3
https://blog.cloudera.com/cloudera-response-to-cve-2021-44228	3
https://blog.ovhcloud.com/log4j-vulnerability-cve-2021-44228/	3
https://forum.chatons.org/t/log4j-java-et-cve-2021-44228-lo...	3
https://help.canary.tools/hc/en-gb/articles/4413465229201-U...	3
https://issues.apache.org/jira/browse/LOG4J2-3201	3
https://pentest-tools.com/blog/log4j-vulnerability-cve-2021...	3
https://serviceinfo.au.dk/Home/Message/4332	3
https://support.plesk.com/hc/en-us/articles/4412182812818-I...	3
https://www.itmedia.co.jp/news/articles/2112/10/news157.html	3
https://www.kaspersky.com/blog/log4shell-critical-vulnerabi...	3
https://www.microsoft.com/security/blog/2021/12/11/guidance...	3
https://www.pwndefend.com/2022/01/07/log4shell-exploitation...	3
https://www.sumologic.com/blog/log4shell-cve-2021-44228	3
http://ComputerWeekly.com	3
https://blog.detectify.com/2021/12/12/important-information...	3
https://dev.classmethod.jp/articles/aws-waf-new-rule-log4jrce/	3
https://discuss.elastic.co/t/apache-log4j2-remote-code-exec...	3
https://greenlock.ghost.io/log4j-ou-log4shell-la-javapocaly...	3
https://jpazpaas.github.io/blog/2021/12/13/log4shell-on-app...	3
https://logging.apache.org/log4j/2.x/security.html	3
https://support.citrix.com/article/CTX335705	3
https://www.cybereason.com/blog/cybereason-solutions-are-no...	3
https://www.infiniroot.com/blog/1155/using-nginx-lua-script...	3
https://www.solarwinds.com/trust-center/security-advisories...	3
https://blog.checkpoint.com/2021/12/11/protecting-against-c...	3
https://community.jitsi.org/t/cve-2021-44228-and-jitsi-comp...	3
https://fidelissecurity.com/threatgeek/threat-intelligence/...	3
https://securityonline.info/log4j-detector-detects-vulnerab...	3
https://www.crowdstrike.com/blog/log4j2-vulnerability-analy...	3
https://www.darkreading.com/dr-tech/how-do-i-find-which-ser...	3
https://www.sentinelone.com/blog/cve-2021-44228-staying-sec...	3
https://www.systemtek.co.uk/2021/12/critical-apache-log4j-r...	3
https://www.theregister.com/2021/12/14/apache_log4j_2_16_jn...	3
https://blog.crossidea.co.jp/2021/3082	3
https://blogs.blackberry.com/en/2021/12/the-log4shell-log4j...	3
https://blogs.networld.co.jp/entry/2021/12/12/210529	3
https://community.riskiq.com/article/505098fc	3
https://community.tanium.com/s/article/How-Tanium-Can-Help-...	3
https://support.arcserve.com/s/article/2021121301?language=ja	3
https://support.broadcom.com/security-advisory/content/secu...	3
https://www.cadosecurity.com/analysis-of-initial-in-the-wil...	3
https://www.cert.ssi.gouv.fr/alerte/CERTFR-2021-ALE-022/	3
https://www.cybereason.co.jp/blog/cyberattack/7301/	3
https://www.deepinstinct.com/blog/log4shell-cve-2021-44228-...	3
https://www.securityweek.com/companies-respond-log4shell-vu...	3
https://www.shadowserver.org/news/log4j-scanning-and-cve-20...	3
https://www.techsolvency.com/story-so-far/cve-2021-44228-lo...	3
https://blog.pfs.nifcloud.com/20211213_Log4jShell	3
https://blog.segu-info.com.ar/2021/12/log4shell-vulnerabili...	3
https://noticiasseguridad.com/vulnerabilidades/detalles-de-...	3
https://portal.microfocus.com/s/customportalsearch?language...	3
https://research.nccgroup.com/2021/12/12/log4j-jndi-be-gone...	3
https://securityboulevard.com/2021/12/log4j-exploit-detecti...	3
https://www.intellilink.co.jp/column/vulner/2021/121500.aspx	3
https://www.picussecurity.com/resource/blog/simulating-and-...	3
https://log4shell.huntress.com/	3
https://piyolog.hatenadiary.jp/entry/2021/12/13/045541	3
https://success.trendmicro.com/solution/000289940	3
https://www.alexvanwolferen.nl/sitecore-solr-fix-log4j-cve-...	3
https://www.hackingarticles.in/a-detailed-guide-on-log4j-pe...	3
https://www.miltonsecurity.com/company/contact-us	3
http://account.cometbackup.com	3
https://community.mailcow.email/d/1229-cve-2021-44228-vulne...	3
https://msrc-blog.microsoft.com/2021/12/11/microsofts-respo...	3
https://packetstormsecurity.com/files/165307/CVE-2021-44228...	3
https://securityforeveryone.com/blog/log4shell-log4j-0-day-...	3
https://www.claudiokuenzler.com/blog/1155/using-nginx-lua-s...	3
https://ankur-katiyar.medium.com/cve-2021-44228-proof-of-co...	3
https://nakedsecurity.sophos.com/2021/12/13/log4shell-expla...	3
https://www.bleepingcomputer.com/news/security/new-zero-day...	3
https://cloudsecurityalliance.org/articles/dealing-with-log...	3
https://community.carbonblack.com/t5/Documentation-Download...	3
https://ipssignatures.appspot.com/?cve=CVE-2021-44228	3
https://forest.watch.impress.co.jp/docs/serial/yajiuma/1373...	3
https://community.microstrategy.com/s/article/MicroStrategy...	3
https://ja.confluence.atlassian.com/kb/faq-for-cve-2021-442...	3
https://log4j-tester.trendmicro.com/	3
https://unit42.paloaltonetworks.com/apache-log4j-vulnerabil...	3
https://virtuallyandy.wordpress.com/2021/12/14/using-nsx-id...	3
https://rules.emergingthreatspro.com/open/	3
https://enterprise-support.nvidia.com/s/article/Log4j-Java-...	3
https://security.paloaltonetworks.com/CVE-2021-44228	3
http://maruyama-mitsuhiko.cocolog-nifty.com/security/2021/1...	3

User	URL	Info Source	Date
buaqbot	https://ift.tt/iCNlyfH	Source buaqbot 1630757980076486659	2023/03/01
buaqbot	https://ift.tt/IqiF2Xv	Source buaqbot 1630757980076486659	2023/03/01
o90_______	https://youtu.be/L35_UCtXrRQ	Source o90_______ 1631215143479566336	2023/03/02
fletch_ai	https://bit.ly/3ZIC4Dr	Source fletch_ai 1632915225581084672	2023/03/07
secdim	http://bit.ly/3YLagxy	Source secdim 1636181591981690880	2023/03/16
secdim	https://twitter.com/secdim/status/1636181591981690880/photo/1	Source secdim 1636181591981690880	2023/03/16
fletch_ai	https://bit.ly/3ZSDADv	Source fletch_ai 1636584407820632064	2023/03/17
SasStu	https://bit.ly/42nfHpf	Source SasStu 1636982902583074817	2023/03/18
lxadm_com	https://lxadm.com/cve-2021-44228-spring-boot	Source lxadm_com 1639135973912236032	2023/03/24
GairolaAlok	https://twitter.com/GairolaAlok/status/1640715276760252418/...	Source GairolaAlok 1640715278916132865	2023/03/28
threatintelctr	https://nvd.nist.gov/vuln/detail/CVE-2021-44228	Source threatintelctr 1642987067293552641	2023/04/04
aysun081448101	https://twitter.com/aysun081448101/status/16434604145613045...	Source aysun081448101 1643460416155033600	2023/04/05
kaito834	https://sysdig.com/blog/proxyjacking-attackers-log4j-exploited	Source kaito834 1644923604742836224	2023/04/09
pentesttoolscom	https://pentest-tools.com/blog/log4j-vulnerability-cve-2021...	Source pentesttoolscom 1646096022563704832	2023/04/12
pentesttoolscom	https://pentest-tools.com/blog/log4j-vulnerability-cve-2021...	Source pentesttoolscom 1646096025445359616	2023/04/12
NytroRST	https://pentest-tools.com/blog/log4j-vulnerability-cve-2021...	Source NytroRST 1646106417718349824	2023/04/12
ecoroofrestore1	https://twitter.com/ecoroofrestore1/status/1647631959680598...	Source ecoroofrestore1 1647631962125791232	2023/04/17
KingSC1x	https://nvd.nist.gov/vuln/detail/CVE-2021-44228	Source KingSC1x 1647861059749924864	2023/04/17

URL	Num of Times Referred to
vulmon.com	580
alerts.vulmon.com	225
cvetrends.com	51
cyberiqs.com	44
www.reddit.com	39
twinybots.ch	25
lists.astaro.com	19
cybersec.continuitysoftware.com	18
us-cert.cisa.gov	17
thehackernews.com	16
b.hatena.ne.jp	13
www.truesec.com	10
cybersec.cycognito.com	10
www.jenkins.io	8
lists.apache.org	8
access.redhat.com	8
msrc.microsoft.com	8
www.searchenginejournal.com	8
ift.tt	7
checkmarx.com	7
blogs.juniper.net	7
networks.unify.com	7
t.me	6
zero.bs	6
Tenable.sc	6
www.akamai.com	6
www.mcafee.com	6
kb.paessler.com	6
cloud.google.com	6
www.huntress.com	6
www.creeperhost.net	6
confluence.atlassian.com	6
GlobalSecurityDatabase.org	6
research.kudelskisecurity.com	6
qiita.com	5
slf4j.org	5
opsmtrs.com	5
cyberwatch.fr	5
www.intel.com	5
www.snort.org	5
databricks.com	5
logback.qos.ch	5
www.elastic.co	5
www.nisc.go.jp	5
forum.xwiki.org	5
www.imperva.com	5
tweetedtimes.com	5
www.secuavail.com	5
www.auscert.org.au	5
www.cyberkendra.com	5
scan.netsecurity.ne.jp	5
blog.talosintelligence.com	5
security.stackexchange.com	5
j.mp	4
redis.com	4
spring.io	4
yamory.io	4
prtimes.jp	4
puppet.com	4
github.blog	4
level69.net	4
mackerel.io	4
www.ibm.com	4
deepfence.io	4
www.cisa.gov	4
www.esri.com	4
ivanti.social	4
www.npa.go.jp	4
www.zdnet.com	4
4securitas.com	4
aws.amazon.com	4
pandorafms.com	4
www.rapid7.com	4
www.rumble.run	4
therecord.media	4
tools.cisco.com	4
www.access42.nl	4
www.blumira.com	4
www.cnblogs.com	4
www.mongodb.com	4
www.randori.com	4
about.gitlab.com	4
community.ui.com	4
hub.crowdsec.net	4
tdm.socprime.com	4
www.jpcert.or.jp	4
blog.sonatype.com	4
forums.cpanel.net	4
hardenedvault.net	4
security.sios.com	4
blogs.jpcert.or.jp	4
support.arduino.cc	4
support.claris.com	4
blog.cloudflare.com	4
blogs.quickheal.com	4
hominido.medium.com	4
infosecwriteups.com	4
feeds.feedburner.com	4
news.ycombinator.com	4
corp.moneyforward.com	4
blog.serverworks.co.jp	4
www.securityartwork.es	4
cert-portal.siemens.com	4
minecraft.mixjuice.info	4
research.trendmicro.com	4
www.helpnetsecurity.com	4
milestone-of-se.nesuke.com	4
unit42.paloaltonetworks.jp	4
cs.co	3
bit.ly	3
dev.to	3
buff.ly	3
cybr.ly	3
msft.it	3
a-zs.net	3
cisa.gov	3
hclsw.co	3
youtu.be	3
anchor.fm	3
earmas.ga	3
tchnk.com	3
github.com	3
sysdig.com	3
ubuntu.com	3
fullhunt.io	3
kloudle.com	3
tolisec.com	3
twitter.com	3
umbraco.com	3
www.cve.org	3
blog.kie.org	3
crowdsec.net	3
csirt.gov.it	3
gigazine.net	3
isc.sans.edu	3
prophaze.com	3
scalingo.com	3
sec.okta.com	3
socprime.com	3
sylarsec.com	3
www.heise.de	3
www.suse.com	3
blogs.sap.com	3
fusionauth.io	3
guardedbox.es	3
kb.vmware.com	3
kc.mcafee.com	3
logrhythm.com	3
microsoft.com	3
smartbear.com	3
tryhackme.com	3
uberagent.com	3
www.ipa.go.jp	3
www.lac.co.jp	3
www.nginx.com	3
www.scutum.jp	3
at-virtual.net	3
attackerkb.com	3
cti.uncoder.io	3
go.trellix.com	3
kb.tableau.com	3
opensearch.org	3
reconshell.com	3
securelist.com	3
support.f5.com	3
threatpost.com	3
www.cadenas.de	3
www.citrix.com	3
www.docker.com	3
www.fastly.com	3
www.lunasec.io	3
www.oracle.com	3
www.splunk.com	3
www.vmware.com	3
arstechnica.com	3
blog.fox-it.com	3
blog.ipfire.org	3
blog.qualys.com	3
core.vmware.com	3
coreruleset.org	3
docs.docker.com	3
gist.github.com	3
help.live2d.com	3
support.sap.com	3
think.unblog.ch	3
www.bsi.bund.de	3
www.maltego.com	3
www.ncsc.gov.uk	3
www.tableau.com	3
www.tenable.com	3
www.youtube.com	3
Scanmycode.today	3
blog.pythian.com	3
blogs.apache.org	3
blogs.oracle.com	3
blogs.vmware.com	3
flink.apache.org	3
wiki.eclipse.org	3
www.blackhat.com	3
www.boxsquare.jp	3
www.greynoise.io	3
www.kitploit.com	3
www.linkedin.com	3
www.mandiant.com	3
www.openwall.com	3
www.softek.co.jp	3
www.traceable.ai	3
www.veracode.com	3
blog.cloudera.com	3
blog.ovhcloud.com	3
forum.chatons.org	3
help.canary.tools	3
issues.apache.org	3
pentest-tools.com	3
serviceinfo.au.dk	3
support.plesk.com	3
www.itmedia.co.jp	3
www.kaspersky.com	3
www.microsoft.com	3
www.pwndefend.com	3
www.sumologic.com	3
ComputerWeekly.com	3
blog.detectify.com	3
dev.classmethod.jp	3
discuss.elastic.co	3
greenlock.ghost.io	3
jpazpaas.github.io	3
logging.apache.org	3
support.citrix.com	3
www.cybereason.com	3
www.infiniroot.com	3
www.solarwinds.com	3
blog.checkpoint.com	3
community.jitsi.org	3
fidelissecurity.com	3
securityonline.info	3
www.crowdstrike.com	3
www.darkreading.com	3
www.sentinelone.com	3
www.systemtek.co.uk	3
www.theregister.com	3
blog.crossidea.co.jp	3
blogs.blackberry.com	3
blogs.networld.co.jp	3
community.riskiq.com	3
community.tanium.com	3
support.arcserve.com	3
support.broadcom.com	3
www.cadosecurity.com	3
www.cert.ssi.gouv.fr	3
www.cybereason.co.jp	3
www.deepinstinct.com	3
www.securityweek.com	3
www.shadowserver.org	3
www.techsolvency.com	3
blog.pfs.nifcloud.com	3
blog.segu-info.com.ar	3
noticiasseguridad.com	3
portal.microfocus.com	3
research.nccgroup.com	3
securityboulevard.com	3
www.intellilink.co.jp	3
www.picussecurity.com	3
log4shell.huntress.com	3
piyolog.hatenadiary.jp	3
success.trendmicro.com	3
www.alexvanwolferen.nl	3
www.hackingarticles.in	3
www.miltonsecurity.com	3
account.cometbackup.com	3
community.mailcow.email	3
msrc-blog.microsoft.com	3
packetstormsecurity.com	3
securityforeveryone.com	3
www.claudiokuenzler.com	3
ankur-katiyar.medium.com	3
nakedsecurity.sophos.com	3
www.bleepingcomputer.com	3
cloudsecurityalliance.org	3
community.carbonblack.com	3
ipssignatures.appspot.com	3
forest.watch.impress.co.jp	3
community.microstrategy.com	3
ja.confluence.atlassian.com	3
log4j-tester.trendmicro.com	3
unit42.paloaltonetworks.com	3
virtuallyandy.wordpress.com	3
rules.emergingthreatspro.com	3
enterprise-support.nvidia.com	3
security.paloaltonetworks.com	3
maruyama-mitsuhiko.cocolog-nifty.com	3

User	URL	Info Source
buaqbot	ift.tt	Show Tweet
buaqbot	ift.tt	Show Tweet
o90_______	youtu.be	Show Tweet
fletch_ai	bit.ly	Show Tweet
secdim	bit.ly	Show Tweet
secdim	twitter.com	Show Tweet
fletch_ai	bit.ly	Show Tweet
SasStu	bit.ly	Show Tweet
lxadm_com	lxadm.com	Show Tweet
GairolaAlok	twitter.com	Show Tweet
threatintelctr	nvd.nist.gov	Show Tweet
aysun081448101	twitter.com	Show Tweet
kaito834	sysdig.com	Show Tweet
pentesttoolscom	pentest-tools.com	Show Tweet
pentesttoolscom	pentest-tools.com	Show Tweet
NytroRST	pentest-tools.com	Show Tweet
ecoroofrestore1	twitter.com	Show Tweet
KingSC1x	nvd.nist.gov	Show Tweet

Name	URL
logpresso/CVE-2021-44228-Scanner	https://github.com/logpresso/CVE-2021-44228-Scanner
kozmer/log4j-shell-poc	https://github.com/kozmer/log4j-shell-poc
christophetd/log4shell-vulnerable-app	https://github.com/christophetd/log4shell-vulnerable-app
CERTCC/CVE-2021-44228_scanner	https://github.com/CERTCC/CVE-2021-44228_scanner
jas502n/Log4j2-CVE-2021-44228	https://github.com/jas502n/Log4j2-CVE-2021-44228
fullhunt/log4j-scan	https://github.com/fullhunt/log4j-scan
Puliczek/CVE-2021-44228-PoC-log4j-bypass-words	https://github.com/Puliczek/CVE-2021-44228-PoC-log4j-bypass-words
mubix/CVE-2021-44228-Log4Shell-Hashes	https://github.com/mubix/CVE-2021-44228-Log4Shell-Hashes
fox-it/log4j-finder	https://github.com/fox-it/log4j-finder
f0ng/log4j2burpscanner	https://github.com/f0ng/log4j2burpscanner

CVE-2021-44228

Description from NVD

▼ CVSS3 Vec CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

▼ CVSS2 Vec AV:N/AC:M/Au:N/C:C/I:C/A:C

NVD References

Refer to Information on External Sites

▼ Show Information from Twitter(18)

▼ Show Information from Twitter(18)