CVE-2021-45046 Apache Log4j2
Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.
- CVSS
- not scored
On CISA’s exploited list
Apache Log4j2 Deserialization of Untrusted Data Vulnerability
- Added
- 2023-05-01
- Federal patch deadline
- 2023-05-22
- Ransomware use
- known