vulnerability

IBM WebSphere Application Server: CVE-2021-4104: Multiple vulnerabilities in Apache log4j affect the IBM WebSphere Application Server and IBM WebSphere Application Server Liberty

Try Surface Command
Back to search
Severity
6
CVSS
(AV:N/AC:M/Au:S/C:P/I:P/A:P)
Published
12/14/2021
Added
08/26/2022
Modified
11/08/2023

Description

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Solution(s)

ibm-was-install-17-0-0-3-ph42762-libertyibm-was-install-7-0-0-0-ph42762ibm-was-install-8-0-0-0-ph42762ibm-was-install-8-5-0-0-ph42762ibm-was-install-9-0-0-0-ph42762ibm-was-upgrade-17-0-0-3-22-0-0-1-libertyibm-was-upgrade-8-5-0-0-8-5-5-21ibm-was-upgrade-9-0-0-0-9-0-5-11

References

Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today