CVE-2021-45105 Apache Log4j
| Affected software | Apache Log4j |
|---|---|
| Severity | 5.9 Medium CVSS 3.1 3 scores |
| Fixed in | 2.12.3, 2.17.0, 2.3.1 |
| Weakness | Improper input validation (CWE-20) |
| Published | 18 Dec 2021 |
| Updated | 25 Aug 2026 |
Description
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
CWE-674
Exploitation status
Exploited
Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV listed Exploitation reported in the wild. 17 citations · 6 exploits · earliest 2021-12-22.
- CISA Vulnrichment exploitation: none
- Indexed PoC 5 indexed Published artifacts you can open, in GitHub PoC; first seen 2021-12-18.
- EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2021-45105 in VulnCheck (free account), which lists 12 more citations and 1 more exploit reference not shown here.
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Log4j_dos_CVE-2021-45105 | 13 | 2021-12-18 |
| GitHub PoC | log4j2 dos exploit,CVE-2021-45105 exploit,Denial of Service poc | 3 | 2021-12-20 |
| GitHub PoC | Discover and remediate Log4Shell vulnerability [CVE-2021-45105] | 2 | 2021-12-23 |
| GitHub PoC | Example payloads for CVE-2021-45105 low complexity vector | 2022-04-03 | |
| GitHub PoC | Replicating CVE-2021-45105 | 2021-12-19 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available patch rule
- Review human ARMR file
- Record active
| Decided by | An ARMR patch file on disk for this CVE |
|---|---|
| Finding | CVE has an ARMR patch rule that provides mitigation |
ARMR rule files
1 fileThe rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.
CVE-2021-45105.armr patch rule, ARMR 2.6 added 2021-12-21 updated 2026-03-04How to mitigate CVE-2021-45105
Upgrade Apache Log4j to a release that fixes it: 2.12.3, 2.17.0 or 2.3.1. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
5.9 MEDIUM
v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
3 metrics
CVSS
5.9 MEDIUM v3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
NVD | Primary | published |
| CVSS 3.1 | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 4.3 | none | AV:N/AC:M/Au:N/C:N/I:N/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update January 2026 ↗ | CPU | 2026-Q1 | Oracle Fusion Middleware / Core (Apache Log4j) (12.2.1.4.0) |
| Oracle Critical Patch Update July 2023 ↗ | CPU | 2023-Q3 | Oracle Enterprise Manager / Load Testing for Web Apps (Apache Log4j) (13.3.0.1) |
| Oracle Critical Patch Update January 2023 ↗ | CPU | 2023-Q1 | Oracle Utilities Applications / System Wide (Apache Log4j) (2.3.0.2, 2.4.0.1, 2.5.0.0-2.5.0.2) |
| Oracle Critical Patch Update January 2022 ↗ | CPU | 2022-Q1 | Oracle Communications / API Portal (Apache Log4j) (7.0) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Communications / Integration (Apache Log4j) (6.2) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Communications / Signaling Engine, Media Engine (Apache Log4j) (7.2.0, 7.2.1) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Construction and Engineering / Logging (Apache Log4j) (17.1, 17.2, 17.3) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Financial Services Applications / Installer & Configuration (Apache Log4j) (8.0.8, 8.1.0, 8.1.1) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Financial Services Applications / Others (Apache Log4j) (8.0.7-8.1.1) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Fusion Middleware / Analytics Server (Apache Log4j) (5.5.0.0.0) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Fusion Middleware / MFT Runtime Server (Apache Log4j) (12.2.1.3.0, 12.2.1.4.0) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Fusion Middleware / Security Framework (Apache Log4j) (12.2.1.3.0, 12.2.1.4.0) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Retail Applications / Administration (Apache Log4j) (14.1) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Retail Applications / Installation (Apache Log4j) (16.0.3, 17.0.2, 18.0.1, 19.0.1, 20.0.1) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Retail Applications / RIB Kernal (Apache Log4j) (14.1.3.0, 14.1.3.2, 15.0.3.1, 16.0.1-16.0.3, 19.0.0, 19.0.1) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Retail Applications / RPAS Server (Apache Log4j) (14.1.3.46, 15.0.3.115, 16.0.3.240) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Retail Applications / RSB Installation (Apache Log4j) (14.1.3.0, 14.1.3.2, 15.0.3.1, 16.0.1-16.0.3, 19.0.0, 19.0.1) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Retail Applications / Security (Apache Log4j) (13.2, 14.0.4, 14.1.3, 15.0.3, 16.0.3) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Retail Applications / Security (Apache Log4j) (14.1) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Retail Applications / Security (Apache Log4j) (14.1) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Retail Applications / Security (Apache Log4j) (14.1) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Retail Applications / Security (Apache Log4j) (15.0.3, 16.0.3) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Retail Applications / System Administration (Apache Log4j) (16.0, 18.0, 19.1) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. Oracle Retail Applications / Upgrade Install (Apache Log4j) (19.5) Oracle's note: This patch also addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications | API Portal (Apache Log4j) | 7.0 | 7.0 |
| Oracle Communications | Integration (Apache Log4j) | 6.2 | 6.2 |
| Oracle Communications | Signaling Engine, Media Engine (Apache Log4j) | 7.2.0, 7.2.1 | 7.2.0 · 7.2.1 |
| Oracle Construction and Engineering | Logging (Apache Log4j) | 17.1, 17.2, 17.3 | 17.1 · 17.2 · 17.3 |
| Oracle Enterprise Manager | Load Testing for Web Apps (Apache Log4j) | 13.3.0.1 | 13.3.0.1 |
| Oracle Financial Services Applications | Installer & Configuration (Apache Log4j) | 8.0.8, 8.1.0, 8.1.1 | 8.0.8 · 8.1.0 · 8.1.1 |
| Oracle Financial Services Applications | Others (Apache Log4j) | 8.0.7-8.1.1 | |
| Oracle Fusion Middleware | Analytics Server (Apache Log4j) | 5.5.0.0.0 | 5.5.0.0.0 |
| Oracle Fusion Middleware | Core (Apache Log4j) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | MFT Runtime Server (Apache Log4j) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Fusion Middleware | Security Framework (Apache Log4j) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Retail Applications | Administration (Apache Log4j) | 14.1 | 14.1 |
| Oracle Retail Applications | Installation (Apache Log4j) | 16.0.3, 17.0.2, 18.0.1, 19.0.1, 20.0.1 | 16.0.3 · 17.0.2 · 18.0.1 · 19.0.1 · 20.0.1 |
| Oracle Retail Applications | RIB Kernal (Apache Log4j) | 14.1.3.0, 14.1.3.2, 15.0.3.1, 16.0.1-16.0.3, 19.0.0, 19.0.1 | 14.1.3.0 · 14.1.3.2 · 15.0.3.1 · 19.0.0 · 19.0.1 |
| Oracle Retail Applications | RPAS Server (Apache Log4j) | 14.1.3.46, 15.0.3.115, 16.0.3.240 | 14.1.3.46 · 15.0.3.115 · 16.0.3.240 |
| Oracle Retail Applications | RSB Installation (Apache Log4j) | 14.1.3.0, 14.1.3.2, 15.0.3.1, 16.0.1-16.0.3, 19.0.0, 19.0.1 | 14.1.3.0 · 14.1.3.2 · 15.0.3.1 · 19.0.0 · 19.0.1 |
| Oracle Retail Applications | Security (Apache Log4j) | 13.2, 14.0.4, 14.1.3, 15.0.3, 16.0.3 | 13.2 · 14.0.4 · 14.1 · 14.1.3 · 15.0.3 · 16.0.3 |
| Oracle Retail Applications | System Administration (Apache Log4j) | 16.0, 18.0, 19.1 | 16.0 · 18.0 · 19.1 |
| Oracle Retail Applications | Upgrade Install (Apache Log4j) | 19.5 | 19.5 |
| Oracle Utilities Applications | System Wide (Apache Log4j) | 2.3.0.2, 2.4.0.1, 2.5.0.0-2.5.0.2 | 2.3.0.2 · 2.4.0.1 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.logging.log4j:log4j-core |
2.4.0 | 2.12.3 |
unbounded |
org.apache.logging.log4j:log4j-core |
2.13.0 | 2.17.0 |
unbounded |
org.apache.logging.log4j:log4j-core |
0 | 2.3.1 |
unbounded |
org.ops4j.pax.logging:pax-logging-log4j2 |
1.8.0 | 1.9.2 |
unbounded |
org.ops4j.pax.logging:pax-logging-log4j2 |
1.10.0 | 1.10.9 |
unbounded |
org.ops4j.pax.logging:pax-logging-log4j2 |
1.11.0 | 1.11.12 |
unbounded |
org.ops4j.pax.logging:pax-logging-log4j2 |
2.0.0 | 2.0.13 |
unbounded |
Products and versions
118 products, 214 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | log4j | generic | ≥ 2.0 and ＜ 2.3.1 · ≥ 2.4 and ＜ 2.12.3 · ≥ 2.13.0 and ≤ 2.16.0 |
| nvd | debian | debian linux | generic | 10.0 · 11.0 |
| nvd | netapp | cloud manager | generic | any version |
| nvd | oracle | agile engineering data management | generic | 6.2.1.0 |
| nvd | oracle | agile plm mcad connector | generic | 3.6 |
| nvd | oracle | agile product lifecycle management | generic | 9.3.6 |
| nvd | oracle | autovue for agile product lifecycle management | generic | 21.0.2 |
| nvd | oracle | banking deposits and lines of credit servicing | generic | 2.12.0 |
| nvd | oracle | banking enterprise default management | generic | 2.7.1 · 2.12.0 |
| nvd | oracle | banking loans servicing | generic | 2.12.0 |
| nvd | oracle | banking party management | generic | 2.7.0 |
| nvd | oracle | banking payments | generic | 14.5 |
| nvd | oracle | banking platform | generic | 2.6.2 · 2.7.1 · 2.12.0 |
| nvd | oracle | banking trade finance | generic | 14.5 |
| nvd | oracle | banking treasury management | generic | 14.5 |
| nvd | oracle | business intelligence | generic | 5.5.0.0.0 |
| nvd | oracle | communications asap | generic | 7.3 |
| nvd | oracle | communications billing and revenue management | generic | 12.0.0.4 · 12.0.0.5 |
| nvd | oracle | communications cloud native core console | generic | 1.9.0 |
| nvd | oracle | communications cloud native core network function cloud native environment | generic | 1.10.0 |
| nvd | oracle | communications cloud native core network repository function | generic | 1.15.0 · 1.15.1 |
| nvd | oracle | communications cloud native core network slice selection function | generic | 1.8.0 |
| nvd | oracle | communications cloud native core policy | generic | 1.15.0 |
| nvd | oracle | communications cloud native core security edge protection proxy | generic | 1.7.0 |
| nvd | oracle | communications cloud native core service communication proxy | generic | 1.15.0 |
| nvd | oracle | communications cloud native core unified data repository | generic | 1.15.0 |
| nvd | oracle | communications convergence | generic | 3.0.2.2.0 · 3.0.3.0 |
| nvd | oracle | communications convergent charging controller | generic | 6.0.1.0.0 · ≥ 12.0.1.0.0 and ≤ 12.0.4.0.0 |
| nvd | oracle | communications diameter signaling router | generic | ≥ 8.3.0.0 and ≤ 8.5.1.0 |
| nvd | oracle | communications eagle element management system | generic | 46.6 |
| nvd | oracle | communications eagle ftp table base retrieval | generic | 4.5 |
| nvd | oracle | communications element manager | generic | ＜ 9.0 |
| nvd | oracle | communications evolved communications application server | generic | 7.1 |
| nvd | oracle | communications interactive session recorder | generic | 6.3 · 6.4 |
| nvd | oracle | communications ip service activator | generic | 7.4.0 |
| nvd | oracle | communications messaging server | generic | 8.1 |
| nvd | oracle | communications network charging and control | generic | 6.0.1.0.0 · ≥ 12.0.1.0.0 and ≤ 12.0.4.0.0 |
| nvd | oracle | communications network integrity | generic | 7.3.6 |
| nvd | oracle | communications performance intelligence center | generic | 10.4.0.3 |
| nvd | oracle | communications pricing design center | generic | 12.0.0.4 · 12.0.0.5 |
| nvd | oracle | communications service broker | generic | 6.2 |
| nvd | oracle | communications services gatekeeper | generic | 7.0 |
| nvd | oracle | communications session report manager | generic | ＜ 9.0 |
| nvd | oracle | communications session route manager | generic | ＜ 9.0 |
| nvd | oracle | communications unified inventory management | generic | 7.3.5 · 7.4.1 · 7.4.2 |
| nvd | oracle | communications user data repository | generic | 12.4 |
| nvd | oracle | communications webrtc session controller | generic | 7.2.0.0 · 7.2.1 |
| nvd | oracle | data integrator | generic | 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | oracle | e-business suite | generic | 12.2 |
| nvd | oracle | enterprise manager base platform | generic | 13.4.0.0 · 13.5.0.0 |
| nvd | oracle | enterprise manager for peoplesoft | generic | 13.4.1.1 · 13.5.1.1 |
| nvd | oracle | enterprise manager ops center | generic | 12.4.0.0 |
| nvd | oracle | financial services analytical applications infrastructure | generic | ≥ 8.0.7 and ≤ 8.1.1 |
| nvd | oracle | financial services model management and governance | generic | 8.0.8.0.0 · 8.1.0.0.0 · 8.1.1.0.0 |
| nvd | oracle | flexcube universal banking | generic | 11.83.3 · ≥ 12.1.0 and ≤ 12.4 · ≥ 14.0.0 and ≤ 14.3.0 · 14.5 |
| nvd | oracle | health sciences empirica signal | generic | 9.1.0.6 · 9.2.0.0 |
| nvd | oracle | health sciences inform | generic | 6.2.1.1 · 6.3.2.1 · 7.0.0.0 |
| nvd | oracle | health sciences information manager | generic | ≥ 3.0.1 and ≤ 3.0.4 |
| nvd | oracle | healthcare data repository | generic | 8.1.1 |
| nvd | oracle | healthcare foundation | generic | ≥ 7.3.0.1 and ≤ 7.3.0.4 |
| nvd | oracle | healthcare master person index | generic | 5.0.1 |
| nvd | oracle | healthcare translational research | generic | 4.1.0 · 4.1.1 |
| nvd | oracle | hospitality suite8 | generic | 8.13.0 · 8.14.0 |
| nvd | oracle | hospitality token proxy service | generic | 19.2 |
| nvd | oracle | hyperion bi\+ | generic | ＜ 11.2.8.0 |
| nvd | oracle | hyperion data relationship management | generic | ＜ 11.2.8.0 |
| nvd | oracle | hyperion infrastructure technology | generic | ＜ 11.2.8.0 |
| nvd | oracle | hyperion planning | generic | ＜ 11.2.8.0 |
| nvd | oracle | hyperion profitability and cost management | generic | ＜ 11.2.8.0 |
| nvd | oracle | hyperion tax provision | generic | ＜ 11.2.8.0 |
| nvd | oracle | identity management suite | generic | 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | oracle | identity manager connector | generic | 9.1.0 |
| nvd | oracle | instantis enterprisetrack | generic | 17.1 · 17.2 · 17.3 |
| nvd | oracle | insurance data gateway | generic | 1.0.1 |
| nvd | oracle | insurance insbridge rating and underwriting | generic | 5.2.0 · ≥ 5.4 and ≤ 5.6.0.0 · 5.6.1.0 |
| nvd | oracle | jdeveloper | generic | 12.2.1.4.0 |
| nvd | oracle | managed file transfer | generic | 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | oracle | management cloud engine | generic | 1.5.0 |
| nvd | oracle | mysql enterprise monitor | generic | ≤ 8.0.29 |
| nvd | oracle | payment interface | generic | 19.1 · 20.3 |
| nvd | oracle | peoplesoft enterprise peopletools | generic | 8.58 · 8.59 |
| nvd | oracle | primavera gateway | generic | ≥ 17.12.0 and ≤ 17.12.11 · ≥ 18.8.0 and ≤ 18.8.13 · ≥ 19.12.0 and ≤ 19.12.12 · ≥ 20.12.0 and ≤ 20.12.7 · 21.12.0 |
| nvd | oracle | primavera p6 enterprise project portfolio management | generic | ≥ 19.12.0.0 and ≤ 19.12.18.0 · ≥ 20.12.0.0 and ≤ 20.12.12.0 · 21.12.0.0 |
| nvd | oracle | primavera unifier | generic | 18.8 · 19.12 · 20.12 · 21.12 |
| nvd | oracle | retail back office | generic | 14.1 |
| nvd | oracle | retail central office | generic | 14.1 |
| nvd | oracle | retail customer insights | generic | 15.0.2 · 16.0.2 |
| nvd | oracle | retail data extractor for merchandising | generic | 15.0.2 · 16.0.2 |
| nvd | oracle | retail eftlink | generic | 16.0.3 · 17.0.2 · 18.0.1 · 19.0.1 · 20.0.1 · 21.0.0 |
| nvd | oracle | retail financial integration | generic | 14.1.3.2 · 15.0.3.1 · ≥ 16.0.1 and ≤ 16.0.3 · 19.0.0 · 19.0.1 |
| nvd | oracle | retail integration bus | generic | 14.1.3 · 14.1.3.2 · 15.0.3.1 · ≥ 16.0.1 and ≤ 16.0.3 · 19.0.0 · ≥ 19.0.0 and ≤ 19.0.1.0 · 19.0.1 |
| nvd | oracle | retail invoice matching | generic | 15.0.3 · 16.0.3 |
| nvd | oracle | retail merchandising system | generic | 16.0.3 · 19.0.1 |
| nvd | oracle | retail order broker | generic | 16.0 · 18.0 · 19.1 |
| nvd | oracle | retail order management system | generic | 19.5 |
| nvd | oracle | retail point-of-service | generic | 14.1 |
| nvd | oracle | retail predictive application server | generic | 14.1.3.46 · 15.0.3.115 · 16.0.3.240 |
| nvd | oracle | retail price management | generic | 13.2 · 14.0.4 · 14.1.3.0 · 15.0.3.0 · 16.0.3.0 |
| nvd | oracle | retail returns management | generic | 14.1 |
| nvd | oracle | retail service backbone | generic | 14.1.3 · 14.1.3.2 · 15.0.3.1 · ≥ 16.0.1 and ≤ 16.0.3 · 19.0.0 · 19.0.1 · 19.0.1.0 |
| nvd | oracle | retail store inventory management | generic | 14.0.4.13 · 14.1.3.5 · 14.1.3.14 · 15.0.3.3 · 15.0.3.8 · 16.0.3.7 |
| nvd | oracle | siebel ui framework | generic | ≤ 21.12 |
| nvd | oracle | sql developer | generic | ＜ 21.4.2 |
| nvd | oracle | taleo platform | generic | ＜ 22.1 |
| nvd | oracle | utilities framework | generic | ≥ 4.3.0.1.0 and ≤ 4.3.0.6.0 · 4.4.0.0.0 · 4.4.0.2.0 · 4.4.0.3.0 |
| nvd | oracle | webcenter portal | generic | 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | oracle | webcenter sites | generic | 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | oracle | weblogic server | generic | 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
| osv | org.apache.logging.log4j | log4j-core | generic | ＜ 2.3.1 · ≥ 2.4.0 and ＜ 2.12.3 · ≥ 2.13.0 and ＜ 2.17.0 |
| osv | org.ops4j.pax.logging | pax-logging-log4j2 | generic | ≥ 1.8.0 and ＜ 1.9.2 · ≥ 1.10.0 and ＜ 1.10.9 · ≥ 1.11.0 and ＜ 1.11.12 · ≥ 2.0.0 and ＜ 2.0.13 |
| nvd | sonicwall | 6bk1602-0aa12-0tp0 firmware | generic | ＜ 2.7.0 |
| nvd | sonicwall | 6bk1602-0aa22-0tp0 firmware | generic | ＜ 2.7.0 |
| nvd | sonicwall | 6bk1602-0aa32-0tp0 firmware | generic | ＜ 2.7.0 |
| nvd | sonicwall | 6bk1602-0aa42-0tp0 firmware | generic | ＜ 2.7.0 |
| nvd | sonicwall | 6bk1602-0aa52-0tp0 firmware | generic | ＜ 2.7.0 |
| nvd | sonicwall | email security | generic | ≤ 10.0.12 |
| nvd | sonicwall | network security manager | generic | ≥ 2.0 and ＜ 3.0 |
| nvd | sonicwall | web application firewall | generic | ≥ 3.0.0 and ＜ 3.1.0 |
References
Timeline
Timeline
| Published | 2021-12-18 | By the CVE Program. |
|---|---|---|
| ARMR remediation created | 2021-12-21 | Earliest commit adding this CVE's ARMR patch or security rule. |
| VulnCheck KEV: earliest evidence | 2021-12-22 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| VulnCheck KEV: latest evidence | 2025-09-15 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| ARMR remediation last updated | 2026-03-04 | Most recent commit touching this CVE's ARMR patch or security rule. |
| Last VRT activity | 2026-03-04 | Most recent commit touching this CVE's classification, patch or rule file. |
| NVD record modified | 2026-08-25 | NVD's own last-modified date for this record. |