---
cve: "CVE-2021-44832"
severity: "MEDIUM"
cvss: 6.6
epss: "97.9%"
vendor: "Apache Software Foundation"
kev: false
exploited: false
published: "2021-12-28 20:15:08"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-11-08T16:35:38+01:00"
---

# CVE-2021-44832

> 6.6 MEDIUM

## Beschreibung

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

## CNA-Record (Kanon, cvelistV5)

- CNA: **apache**
- State: PUBLISHED
- Stand: 2026-05-29 18:53:46

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Hoch | good |
| PR Privilegien | Hoch | good |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-20** — Improper Input Validation
  The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- **CWE-74** — Improper Neutralization of Special Elements in Output Used by a Downstream Component
  The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

## Angriffsmuster (CAPEC)

- [CAPEC-10 — Buffer Overflow via Environment Variables](https://capec.mitre.org/data/definitions/10.html) _(Severity: High)_
- [CAPEC-13 — Subverting Environment Variable Values](https://capec.mitre.org/data/definitions/13.html) _(Severity: Very High)_
- [CAPEC-101 — Server Side Include (SSI) Injection](https://capec.mitre.org/data/definitions/101.html) _(Severity: High)_
- [CAPEC-104 — Cross Zone Scripting](https://capec.mitre.org/data/definitions/104.html) _(Severity: High)_
- [CAPEC-108 — Command Line Execution through SQL Injection](https://capec.mitre.org/data/definitions/108.html) _(Severity: Very High)_
- [CAPEC-109 — Object Relational Mapping Injection](https://capec.mitre.org/data/definitions/109.html) _(Severity: High)_
- [CAPEC-110 — SQL Injection through SOAP Parameter Tampering](https://capec.mitre.org/data/definitions/110.html) _(Severity: Very High)_
- [CAPEC-120 — Double Encoding](https://capec.mitre.org/data/definitions/120.html) _(Severity: Medium)_

## ATT&CK-Techniken

- [T1562.003 — Impair Defenses:Impair Command History Logging](https://attack.mitre.org/techniques/T1562/003/)
- [T1574.006 — Hijack Execution Flow:Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006/)
- [T1574.007 — Hijack Execution Flow:Path Interception by PATH Environment ](https://attack.mitre.org/techniques/T1574/007/)

## Patch verfügbar (OSV)

- dfc35cfb8bdbda7043439ac7027edfa2d400b5c2 (Commit)
- e67bf55e72a54e564ebc822964589f252611ed1a (Commit)

## BSI-Hinweise (deutsch)

- [Juniper Produkte: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2024-0064) — _BSI-Einstufung: hoch_
  Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer, authentisierter, lokaler oder physischer Angreifer kann mehrere Schwachstellen in Juniper JUNOS, Juniper JUNOS Evolved, Juniper SRX Series, Juniper EX Series, Juniper QFX Series, Juniper ACX Series, Juniper PTX Series und Juniper MX Series ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen und seine Berechtigungen zu erweitern.
- [Oracle Retail Applications: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2023-1031) — _BSI-Einstufung: hoch_
  Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Retail Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- [Oracle Supply Chain: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2023-0122) — _BSI-Einstufung: mittel_
  Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Supply Chain ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

## Referenzen

- <https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd>
- <https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143>
- <https://issues.apache.org/jira/browse/LOG4J2-3293>
- <http://www.openwall.com/lists/oss-security/2021/12/28/1>
- <https://lists.debian.org/debian-lts-announce/2021/12/msg00036.html>
- <https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf>
- <https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA/>
- <https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC/>
- <https://www.oracle.com/security-alerts/cpujan2022.html>
- <https://security.netapp.com/advisory/ntap-20220104-0001/>
- <https://www.oracle.com/security-alerts/cpuapr2022.html>
- <https://www.oracle.com/security-alerts/cpujul2022.html>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2021-44832/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_