CVE-2021-45046 — CVE & Security Advisory Radar

🎯 CVE-2021-45046 CRITICAL 9.0 🔥 EPSS 100% ⚠️ CISA KEV · 1222 T 🔓 Exploited 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2021-45046 | It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an i

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

Klassifikation & Betroffenheit:

Apache Software Foundation Apache Log4j Apache Log4j2 <2.16.0apache log4j *apache log4j 2.0siemens sppa-t3000_ses3000_firmware *siemens captial *siemens captial 2019.1siemens comos *siemens desigo_cc_advanced_reports 4.0

Improper Control of Generation of Code ('Code Injection') 🎯 Medium

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

🛡️ Empfohlene Mitigation: Refactor your program so that you do not have to dynamically generate code.

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-35 · Leverage Executable Code in Non-Executab… (Very High) CAPEC-77 · Manipulating User-Controlled Variables (Very High) CAPEC-242 · Code Injection (High)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1027.006 · Obfuscated Files or Information: H… T1027.009 · Obfuscated Files or Information: E… T1564.009 · Hide Artifacts: Resource Forking

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-46752 10.0 CVE-2026-33453 10.0 CVE-2025-30065 10.0 CVE-2025-24813 10.0 CVE-2024-52046 10.0

🧪 Exploit-Evidenz:

🐙 cckuailong/Log4j_CVE-2021-45046 🐙 BobTheShoplifter/CVE-2021-45046- 🐙 tejas-nagchandi/CVE-2021-45046 🐙 pravin-pp/log4j2-CVE-2021-45046 🐙 mergebase/log4j-samples

🩹 Patch verfügbar (OSV):

🩹 ad361d2e517e765f69db464d9407ac2dd80bc93e (Commit) 🩹 cffe58f6a433ea1ab60ceb129d4c9b3377acda1d (Commit)

📰 Eigene Berichterstattung: ➔ Analysis of Log4Shell vulnerability & CVE-2021-45046 ➔ Analysis of Log4Shell vulnerability & CVE-2021-45046 ➔ Analysis of Log4Shell vulnerability & CVE-2021-45046

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2021

Veröffentlicht 12/2021

Im KEV seit 05/2023

Heute 04.09.

CVSS-Vektor-Analyse: 9.0

AV · Angriffsvektor Netzwerk

AC · Komplexität Hoch

PR · Privilegien Keine

UI · Interaktion Keine

S · Scope Verändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Veröffentlicht:14.12.2021

Aktualisiert:17.06.2026 04:13

Assigner (CNA):apache

EUVD-ID:EUVD-2021-34769

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	2026-08-29	2026-09-02
≥90 %	4	0
≥50 %	4	0
≥10 %	3	0
<10 %	304	300

9.0 CRITICAL

🇪🇺 EUVD ⚠️ KEV

EPSS

100%

CVE-2021-45046 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

🔓 Apache Software Foundation

CVE-2021-45046 | It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an i

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

14.12.2021

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub