CVE-2021-44228: Apache Log4j2 Remote Code Execution (Log4Shell)
Summary
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker-controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.
Why It Matters
CRITICAL severity — known to be exploited in the wild（CISA KEV）；action required: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.；affects Log4j2.
Current Status
- Vulnerability status: Known exploited (CISA KEV)
- Last intelligence update: 2024-11-21 · source: NVD
- CISA KEV added: 2021-12-10 · remediation deadline: 2021-12-24
Entity Activity Timeline
- 2021-12-10 — Added to CISA KEV as known-exploited · action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
- 2021-12-10 — NVD publication / disclosure
- 2024-11-21 — Intelligence record updated（NVD sync）
Severity
CRITICAL
CVSS Score: 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Known Exploited (CISA KEV)
Known Exploited Vulnerability
Added: 2021-12-10 · Remediation deadline: 2021-12-24
For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
Source Attribution
Source: NVD · Updated: 2024-11-21T08:47:47.587 · Confidence: high
Impact
Based on CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — assess confidentiality, integrity, and availability impact via the official vector documentation.
Affected Software
- Log4j2 (Apache) Affected:
2.0-beta9 - 2.15.0Fix:2.15.0
Fix
Upgrade affected software to the fixed version identified above. Apply vendor patches and monitor advisories before exposed systems go unpatched.
Sources & Evidence
Start Investigation
Move from reading to investigating CVE-2021-44228: Apache Log4j2 Remote Code Execution (Log4Shell). The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about CVE-2021-44228: Apache Log4j2 Remote Code Execution (Log4Shell)?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.
Recommended Tools
- CVE LookupOpen the full CVE record — severity, CVSS, affected products, CISA KEV and references.Open CVE record
Every tool runs passively or locally — inputs are never stored and no target is scanned.Start an investigation on this entity →