As cited
Copy frozen at (site build).
vulnerabilities
Analysis of Log4Shell vulnerability & CVE-2021-45046
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Analysis of Log4Shell vulnerability & CVE-2021-45046
Elastic documented its detection and response efforts for Log4Shell (CVE-2021-44228) and disclosed a follow-on vulnerability, CVE-2021-45046, introduced in Log4j 2.15.0 that allows denial of service and remote code execution through alternative lookup code paths. The CVSS score for CVE-2021-45046 was revised from 3.7 to 9.0 after researchers identified that the formatMsgNoLookups mitigation did not prevent exploitation via Thread Context and other attack vectors, prompting Apache to recommend upgrading to patched versions or removing the JndiLookup class from log4j-core.
Why it matters: Organizations running Log4j-dependent applications must immediately patch to safe Log4j versions or remove JndiLookup, as Elastic observed threat actors already exploiting CVE-2021-45046 in production environments and previous mitigations are insufficient.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Analysis of Log4Shell vulnerability & CVE-2021-45046
Elastic documented its detection and response efforts for Log4Shell (CVE-2021-44228) and disclosed a follow-on vulnerability, CVE-2021-45046, introduced in Log4j 2.15.0 that allows denial of service and remote code execution through alternative lookup code paths. The CVSS score for CVE-2021-45046 was revised from 3.7 to 9.0 after researchers identified that the formatMsgNoLookups mitigation did not prevent exploitation via Thread Context and other attack vectors, prompting Apache to recommend upgrading to patched versions or removing the JndiLookup class from log4j-core.
Why it matters: Organizations running Log4j-dependent applications must immediately patch to safe Log4j versions or remove JndiLookup, as Elastic observed threat actors already exploiting CVE-2021-45046 in production environments and previous mitigations are insufficient.
- Source published
- First seen by Cybersecurity Tracker